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Why GAO Did This Study 

The SDVOSB program provides 
federal contracting opportunities to 
business-owning veterans who 
incurred or aggravated disabilities in 
the line of duty. SBA administers the 
government-wide program, while VA 
maintains databases of veterans and 
SDVOSBs and oversees its own 
contracts. GAO has reported several 
times since 2009 that both programs 
were vulnerable to fraud and abuse 
and recommended improvements. In 
October 2010, Congress passed the 
Veterans Small Business Verification 
Act (2010 Act), part of the Veterans' 
Benefits Act of 2010, to provide tools to 
VA to more-thoroughly validate firms' 
eligibility before listing them in VetBiz, 
the database used by VA contracting 
officials to award SDVOSB contracts. 

GAO was asked to assess (1 ) VA's 
progress in addressing remaining 
vulnerabilities to fraud and abuse in its 
SDVOSB program and (2) actions 
taken by SBA or other federal agencies 
to improve government-wide SDVOSB 
fraud-prevention controls. GAO 
reviewed agency documentation and 
interviewed agency officials. GAO also 
investigated cases of alleged fraud and 
abuse. GAO did not project the extent 
of fraud and abuse in the program. 

What GAO Recommends 

GAO recommends that VA take steps 
to ensure that all firms within VetBiz 
have undergone the 2010 Act 
verification process. VA generally 
concurred with the recommendation 
but expressed concern about how 
specific report language characterized 
its program. GAO made some changes 
to the report but continues to believe 
that the program remains vulnerable to 
fraud and abuse. 

View GAO-1 2-697. For more information, 
contact Richard J. Hillman at (202) 512-6722 
or hillmanr@gao.gov. 



What GAO Found 

The Department of Veterans Affairs (VA) Service-Disabled Veteran-Owned Small 
Business (SDVOSB) program remains vulnerable to fraud and abuse. VA has 
made inconsistent statements about its progress verifying firms listed in VetBiz 
using the more-thorough process the agency implemented in response to the 
Veterans Small Business Verification Act (2010 Act). In one communication, VA 
stated that as of February 201 1, all new verifications would use the 2010 Act 
process going forward. However, as of April 1, 2012, 3,717 of the 6,178 
SDVOSB firms (60 percent) listed as eligible in VetBiz had not been verified 
under the 2010 Act process. Of these 3,717 firms, 134 received $90 million in 
new VA SDVOSB set-aside or sole-source contract obligations from November 
30, 201 1 , to April 1 , 2012. While the 2010 Act did not include a deadline for 
verification using the more-thorough process, the presence of firms that have 
only been subjected to the less-stringent process that VA previously used 
represents a continuing vulnerability. VA's Office of Inspector General (OIG) 
reported that the less-stringent process was in many cases insufficient to 
establish control and ownership and in effect allowed businesses to self-certify as 
SDVOSBs with little supporting documentation. VA has taken some positive 
action to enhance its fraud prevention efforts by establishing processes in 
response to 6 of 13 recommendations GAO issued in October 2011, including 
conducting unannounced site visits to high-risk firms and developing procedures 
for referring suspicious SDVOSB applications to the OIG. VA has also begun 
action on some remaining recommendations, such as providing fraud awareness 
training and removing contracts from ineligible firms, though these procedures 
need to be finalized. 

Regarding the government-wide SDVOSB program, no action has been taken by 
agencies to improve fraud-prevention controls. Relying almost solely on firms' 
self-certification, the program continues to lack controls to prevent fraud and 
abuse. The Small Business Administration (SBA) does not verify firms' eligibility 
status, nor does it require that they submit supporting documentation. While SBA 
is under no statutory obligation to create a verification process, five new cases of 
potentially ineligible firms highlight the danger of taking no action. These firms 
received approximately $190 million in SDVOSB contract obligations. In one 
case, a firm found ineligible by VA continued to self-certify as an SDVOSB and 
received about $860,000 from the General Services Administration and the 
Department of Interior. Further, the Department of Defense (DOD) OIG reported 
in 2012 that DOD provided $340 million to firms that potentially misstated their 
SDVOSB status. To address these vulnerabilities, GAO previously suggested 
that Congress consider providing VA with the authority necessary to expand its 
SDVOSB eligibility verification process government-wide. Such an action is 
supported by the fact that VA maintains the database identifying which 
individuals are service-disabled veterans and is consistent with VA's mission of 
service to veterans. However, the problems GAO identified with VA's verification 
process indicate that an expansion of VA's authority to address government-wide 
program problems should not be undertaken until VA demonstrates that its 
process is successful in reducing its own SDVOSB program's vulnerability to 
fraud and abuse. 



United States Government Accountability Office 



Contents 



Letter 




1 




Background 


7 




VA's Program Remains Vulnerable to Fraud and Abuse as a Result 






of a Lack of Inventory Control and Potentially Ineligible Firms 






Listed in VetBiz 


11 




No Action Has Been Taken to Improve Government-wide SDVOSB 






h rn 1 1 rl ProA 7 oil ~t\ r\y\ i nntrnlc 
r IcxULl-JricVcILLlUIL V^UILLI Ulo 


on 




Conclusions 


26 




Recommendations for Executive Action 


26 




Agency Comments and Our Evaluation 


27 


Appendix I 


Comments from the Department of Veterans Affairs 


32 


Related GAO Products 




54 



Figures 



Figure 1: Federal Contracts Awarded to SDVOSBs in Fiscal Year 

2010 9 

Figure 2: GAO's Fraud-Prevention Framework 10 

Figure 3: Status of GAO's Previous Recommendations 16 



Page i 



GAO-12-697 SDVOSB Program 



Abbreviations 



2006 Act 


Veterans Benefits, Health Care, and Information 




Technology Act of 2006 


2010 Act 


Veterans Small Business Verification Act 


CCR 


Central Contractor Registration 


CVE 


Center for Veterans Enterprise 


DOD 


Department of Defense 


DOI 


Department of Interior 


EPLS 


Excluded Parties List System 


FAR 


Federal Acquisition Regulation 


FPDS-NG 


Federal Procurement Data System-Next Generation 


GSA 


General Services Administration 


HUBZone 


Historically Underutilized Business Zone 


NAICS 


North American Industry Classification System 


OIG 


Office of Inspector General 


ORCA 


Online Representations and Certifications Application 


SBA 


Small Business Administration 


SDVOSB 


Service-Disabled Veteran-Owned Small Business 


VA 


Department of Veterans Affairs 


VOSB 


Veteran-Owned Small Business 



This is a work of the U.S. government and is not subject to copyright protection in the 
United States. The published product may be reproduced and distributed in its entirety 
without further permission from GAO. However, because this work may contain 
copyrighted images or other material, permission from the copyright holder may be 
necessary if you wish to reproduce this material separately. 



Page ii 



GAO-12-697 SDVOSB Program 



GAP 

Accountability * Integrity * Reliability 



United States Government Accountability Office 
Washington, DC 20548 



August 1, 2012 

The Honorable Marlin A. Stutzman 
Chairman 

The Honorable Bruce L. Braley 
Ranking Member 

Subcommittee on Economic Opportunity 
Committee on Veterans' Affairs 
House of Representatives 

The Honorable Bill Johnson 
Chairman 

The Honorable Joe Donnelly 
Ranking Member 

Subcommittee on Oversight and Investigations 
Committee on Veterans' Affairs 
House of Representatives 

In fiscal year 2010, federal agencies awarded $10.8 billion in small- 
business obligations to firms in the Service-Disabled Veteran-Owned 
Small Business (SDVOSB) program, according to the Small Business 
Administration (SBA). The SDVOSB program is intended to honor 
business-owning veterans who incurred or aggravated disabilities in the 
line of duty by providing their firms with sole-source and set-aside 
contracting opportunities. 1 Firms must meet several requirements to be 
eligible to participate in the program, such as being majority-owned by 
one or more service-disabled veterans who manage and control daily 
business operations. 2 

SBA, which administers the government-wide SDVOSB program, does 
not verify firms' eligibility for the program, and has stated that its only 
statutory obligation is to report on other agencies' success in meeting 
SDVOSB contracting goals. In 2009, we investigated 10 cases in which 



Veterans Benefits Act of 2003, Pub. L. No. 108-183, § 308, 117 Stat. 2651, 2662 
(codified at 15 U.S.C. § 657f). 

2 lf the business is publicly owned, at least 51 percent of the stock must be held by one or 
more service-disabled veterans. The spouse or permanent caregiver of a veteran with a 
permanent and severe disability may also control the business. See 13 C.F.R. § 125.8(g). 



Page 1 



GAO-12-697 SDVOSB Program 



ineligible firms that self-certified their service-disabled veteran-owned 
business status received about $100 million in SDVOSB contracts. 3 Since 
2009, we have issued nine reports and testimonies detailing how the 
SDVOSB program is vulnerable to fraud and abuse. 4 

Accounting for about 30 percent of government-wide awards, the 
Department of Veterans Affairs (VA) awarded $3.2 billion in SDVOSB 
contracts in fiscal year 2010. Unlike SBA, VA is bound by law to verify 
firms' eligibility; the Veterans Benefits, Health Care, and Information 
Technology Act of 2006 (2006 Act) requires VA to maintain a database of 
SDVOSBs and Veteran-Owned Small Businesses (VOSB), known as 
VetBiz. 5 The 2006 Act also requires that VA verify the ownership, control, 
and veteran or service-disabled status of firms listed in VetBiz to confirm 
that they are eligible to receive VA SDVOSB set-aside and sole-source 
contracts. In response to the 2006 Act, VA chose to implement a 
verification process consisting of checking whether a firm's owner was 
listed in VA's database of service-disabled veterans and conducting 
searches on publicly available websites such as the Excluded Parties List 
System (EPLS), which lists firms that have been debarred from doing 
business with the federal government. Nonetheless, we reported in 2009 
and 2010 that this verification process allowed ineligible firms to be 
wrongly certified. In 201 1 , VA's Office of Inspector General (OIG) also 
reported on the basis of a random selection of 42 firms that 32 of 42 
SDVOSBs and VOSBs listed in the VetBiz database were ineligible for 
the VA SDVOSB program. 6 

As part of our past work, we made recommendations to strengthen both 
government-wide and VA fraud-prevention controls. Further, in response 
to the Veterans Small Business Verification Act (2010 Act), part of the 



3 GAO, Service-Disabled Veteran-Owned Small Business Program: Case Studies Show 
Fraud and Abuse Allowed Ineligible Firms to Obtain Millions of Dollars in Contracts, 
GAO-10-108 (Washington, D.C.: Oct. 23, 2009). 

4 See the list of related GAO products at the end of this report. 

5 Pub. L. No. 109-461, § 502, 120 Stat. 3403, 3431 - 3435 (codified as amended at 38 
U.S.C. §8127). 

6 VA Office of Inspector General (OIG), Department of Veterans Affairs: Audit of Veteran- 
Owned and Service-Disabled Veteran-Owned Small Business Programs, 1 0-02436-234 
(July 25, 2011). 
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Veterans' Benefits Act of 2010, 7 VA implemented a more-thorough 
verification process that includes unannounced and announced site visits, 
and review and analysis of company documentation to validate a firm's 
eligibility as owned and controlled by serviced-disabled veterans before 
listing the firm in VetBiz. In July 201 1 , we reported that both SBA and VA 
had taken positive steps in response to our findings and 
recommendations, but that both the government-wide and VA programs 
remained vulnerable to fraud and abuse. 8 To determine whether the 
program remains vulnerable to fraud and abuse, you requested that we 
update our prior work and report the status of our recommendations. 
Therefore, we assessed (1) VA's progress in addressing remaining 
vulnerabilities to fraud and abuse in its SDVOSB program and (2) actions 
taken by SBA or other federal agencies since our previous reports to 
improve government-wide SDVOSB fraud-prevention controls. 

To assess vulnerabilities in VA's verification process, we reviewed prior 
findings and recommendations from GAO audits and investigations of 
VA's VetBiz verification program, including the status of 
recommendations we issued to VA in October 201 1 . 9 We also reviewed 
VA's standard operating procedures, internal control policies, a VA OIG 
report, and other related documents. 10 We interviewed various agency 
officials about the status of VA's verification efforts. To assess VA's 
progress toward verifying all firms in VetBiz under the 2010 Act, we 
reviewed relevant statutes and regulations governing the program, VA 
guidance, VA statements provided to Congress, and related documents. 
We also interviewed various agency officials. 

To assess actions taken to improve government-wide SDVOSB fraud- 
prevention controls since our previous reports, we reviewed prior findings 
and recommendations from our audits and investigations of the SDVOSB 



7 Pub. L. No. 111-275, § 104, 124 Stat. 2864, 2867-2868 (amending 38 U.S.C. § 8127). 

8 GAO, Service-Disabled Veteran-Owned Small Business Program: Preliminary 
Information on Actions Taken by Agencies to Address Fraud and Abuse and Remaining 
Vulnerabilities, GAO-1 1-589T (Washington, D.C.: July 28, 201 1 ). 

9 GAO, Service-Disabled Veteran-Owned Small Business Program: Additional 
Improvements to Fraud Prevention Controls Are Needed, GAO-1 2-1 52R (Washington, 
D.C.: Oct. 26, 2011). 

10 VA OIG, Department of Veterans Affairs: Audit of Veteran-Owned and Service-Disabled 
Veteran-Owned Small Business Programs. 
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program. We reviewed applicable guidance on internal control standards 
from our Standards for Internal Control in the Federal Government, 11 the 
fraud-prevention framework, 12 and a Department of Defense (DOD) OIG 
report. 13 We requested information from SBA on any actions that it has 
taken in response to our recommendations. We also requested 
information from SBA and VA on any actions taken related to the 10 
cases of ineligible firms identified in our previous work. 14 In addition, we 
contacted agency OIGs who received our fraud referrals pertaining to 
these 10 cases to learn of any action taken against the firms. We also 
searched the Central Contractor Registration (CCR) 15 to determine 
whether original case-study firms were self-certified as SDVOSBs and 
searched VA's VetBiz online database to determine whether original 
case-study firms were listed in the system as verified SDVOSB firms. In 
addition, we searched EPLS to determine if any agencies had suspended 
or debarred 16 the original case-study firms or related individuals we 
investigated. 



11 GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-00-21.3.1 
(Washington, D.C.: Nov. 1999). 

12 GAO, Service-Disabled Veteran-Owned Small Business Program: Fraud Prevention 
Controls Needed to Improve Program Integrity, GAO-10-740T (Washington, D.C.: May 24, 
2010). 

13 DOD OIG, Inadequate Controls Over the DOD Service-Disabled Veteran-Owned Small 
Business Set-Aside Program Allow Ineligible Contractors to Receive Controls, 2012-059 
(Feb. 29, 2012). 

14 For our prior work, we selected cases on the basis of a variety of factors including facts 
and evidence provided in protests and allegations, whether a firm received multiple 
SDVOSB contracts, and whether a firm received other non-SDVOSB contracts. Our prior 
work was not designed to identify all firms that misrepresent themselves as SDVOSBs or 
commit fraudulent or abusive activity, and case examples could not be projected to the 
overall population of SDVOSB firms. 

15 CCR is the primary registrant database for the U.S. federal government. CCR collects, 
validates, stores, and disseminates data in support of agency acquisition missions, 
including federal agency contract and assistance awards. 

16 Suspension and debarment actions prevent companies and individuals from 
participating in government contracts, subcontracts, loans, grants, and other assistance 
programs. The effect of suspension and debarment by a federal agency is government- 
wide. Suspensions are temporary actions, effective immediately, which disqualify a 
company pending the completion of an investigation and generally do not last longer than 
1 year. Debarments, which are imposed after an investigation, result in a set period of 
disqualification, but generally not greater than 3 years. 
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To further assess vulnerabilities in both the government-wide and VA 
SDVOSB fraud-prevention controls, we investigated new allegations from 
informants regarding firms that received SDVOSB contracts through 
fraudulent or abusive eligibility misrepresentations. We did not design our 
work to identify all firms that misrepresent themselves as SDVOSBs or 
commit fraudulent or abusive activity in the SDVOSB program, nor did we 
attempt to identify fraud and abuse in SDVOSB subcontracts. In addition, 
our case examples cannot be projected to the overall population of 
SDVOSB firms. To identify potential cases, we reviewed SDVOSB 
contract awards and protests filed with SBA since 2008 and VA since 

2010. We also analyzed the CCR database and VA's VetBiz database of 
applicants for fraudulent activity and reviewed over 100 allegations of 
fraud and abuse we received from informants between 2009 through 

201 1. From these sources, we selected 10 potential cases 17 for further 
investigation on the basis of a variety of factors, including the credibility 
and specificity of facts and evidence provided in protests and allegations 
and whether a firm received multiple SDVOSB contracts since fiscal year 
2010. We attempted to select case studies from two categories: 
SDVOSBs verified in VetBiz and firms listed in CCR as SDVOSBs that 
were not verified by VA. In addition, these 10 cases were not under 
investigation by the SBA or VA OIGs at the time of selection. 

To validate the facts in these cases, we interviewed some firm owners 
and managers and reviewed relevant documentation, such as business 
filings and tax returns, to determine if SDVOSB eligibility requirements 
had been met. We reviewed certifications made by firms, such as 
certifications about a firm's size, SDVOSB status, and line of business, in 
the federal government's Online Representations and Certifications 
Application (ORCA) 18 and CCR. We also analyzed data from Federal 
Procurement Data System-Next Generation (FPDS-NG) 19 from October 



For the purposes of our investigation, we defined a case-study as one or more affiliated 
firms or joint ventures that obtained SDVOSB set-aside and sole-source contracts. These 
cases include multiple firms owned by an individual or multiple firms affiliated through joint 
ventures and other types of partner agreements. 

18 ORCA is a Web-based system that centralizes and standardizes the collection, storage, 
and viewing of many Federal Acquisition Regulation (FAR) required representations and 
certifications. 

19 The FPDS-NG is the central repository for capturing information on federal procurement 
actions. Dollar amounts reported by federal agencies to FPDS-NG represent the net 
amount of funds obligated and deobligated as a result of procurement actions. 
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2009 through December 201 1 to identify SDVOSB contract obligations 
received by the firms, and confirmed the contract information with 
awarding agencies. We also reviewed Accurint 20 reports to identify 
whether owners and firms had any criminal records and federal tax liens 
and validated this information if necessary. Ultimately, through a 
combination of data matching, a review of public records, and interviews, 
we were able to substantiate the informants' allegations in 4 of the 10 
cases and have gathered enough evidence to indicate firms in a fifth case 
may be ineligible. We have highlighted examples from these 5 cases 
throughout this report and will refer them to SBA and VA and other 
appropriate agencies for further review. We were unable to conclusively 
determine eligibility in the remaining 5 cases. 

To assess the reliability of the data sources used for this report, including 
EPLS, FPDS-NG, and VetBiz, we interviewed agency officials and traced 
information to source documents when possible. We verified the 
suspension and debarment information with SBA and the appropriate 
agencies. We verified the contract obligations with the awarding 
agencies. We also verified the firms' VetBiz SDVOSB verification status 
with VA. We determined that the data were sufficiently reliable for the 
purpose of our audit. We conducted this performance audit from January 
201 1 to July 2012 in accordance with generally accepted government 
auditing standards. 21 Those standards require that we plan and perform 
the audit to obtain sufficient, appropriate evidence to provide a 
reasonable basis for our findings and conclusions based on our audit 
objectives. We believe that the evidence obtained provides a reasonable 
basis for our findings and conclusions based on our audit objectives. We 
performed our investigative work from January 201 1 to July 2012 in 
accordance with the standards prescribed by the Council of the 
Inspectors General on Integrity and Efficiency. 



LexisNexis' Accurint is a database that can provide information on people, businesses, 
assets and locations, including bankruptcy filings, liens and arrest records. 

21 Some of the work in this report is based on prior GAO products issued in 2012, 201 1, 
and 2009. GAO, Service-Disabled Veteran-Owned Small Business Program: 
Governmentwide Fraud Prevention Control Weaknesses Leave Program Vulnerable to 
Fraud and Abuse, but VA Has Made Progress in Improving Its Verification Process, 
GAO-12-443T (Washington, D.C.: Feb. 7, 2012); Service-Disabled Veteran-Owned Small 
Business Program: Additional Improvements to Fraud Prevention Controls Are Needed, 
GAO-12-205T (Washington, D.C.: Nov. 30, 2011); GAO-11-589T; and GAO-10-108. 
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Rark^rminrl Federal regulations set requirements for a small business to qualify as an 

& SDVOSB. SDVOSB eligibility regulations mandate that a firm must be a 

small business and at least 51 percent-owned by one or more service- 
disabled veterans who control the management and daily business 
operations of the firm. Federal statutes and the Federal Acquisition 
Regulations (FAR) require all prospective contractors to update the 
ORCA to state whether their firm qualifies as an SDVOSB. 22 Additionally, 
the SDVOSB, as a contractor, is required to register in CCR. Contracting 
officials are required to check CCR, which includes information such as a 
firm's status as an SDVOSB, prior to awarding most federal contracts, 
including an SDVOSB set-aside or sole-source contract. Once an 
SDVOSB receives a contract, SDVOSB regulations also place restrictions 
on the amount of work that can be subcontracted. 



With regard to VA's program, VA's Center for Veterans Enterprise (CVE) 
is responsible for maintaining VetBiz and implementing VA's verification 
program. The 2010 Act requires that no new small-business applicant 
may appear in VA's SDVOSB and VOSB VetBiz database unless it has 
been verified by VA as owned and controlled by a veteran or service- 
disabled veteran. Further, within 60 days after enactment, VA was 
required to notify all unverified businesses in its VetBiz database about 
the need to provide supporting documents to establish veteran ownership 
and control. Firms were required to do so within 90 days of receipt of the 
notification in order to avoid removal of the firm from VetBiz. 23 To check 
veteran status, CVE relies in part on VA's Beneficiary Identification 
Records Locator Subsystem, which confirms that owners are documented 
as having left service with other than a dishonorable discharge and that 
disability results from a service-connected condition. In response to the 
2010 Act, VA also implemented a verification process that included 
unannounced and announced site visits, and review and analysis of 
company documentation. The 2010 Act does not include a date by which 
VA must complete the verification of firms. Firms that misrepresent 



^15 U.S.C. § 632(x) and 48 C.F.R. § 4.1201. This provision, in addition to others in the 
Small Business Jobs Act of 2010, Pub. L. No. 111-240, §§ 1341-1342, 124 Stat. 2504, 
2543-2544, help facilitate the prosecution of firms that willfully seek and receive small- 
business awards through misrepresentation of their status, including SDVOSBs. 

23 0nce CVE verifies a business, it sends an approval letter to the firm. Under regulations 
first promulgated in 2008, firms retained their eligibility status for 1 year from the date of 
the letter. However, on June 27, 2012, VA issued updated regulations extending the 
eligibility period to 2 years before reverification is required. 
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SDVOSB status are required by law to be debarred from contracting with 
VA for a reasonable period of time, as determined by VA. 24 Additionally, 
VA regulations state that if a firm or owner is currently debarred or 
suspended, or is delinquent or in default on significant financial 
obligations owed to the federal government, then the firm or owner is 
ineligible for VA's VetBiz verification program. 25 

Federal law has established government-wide goals for specific types of 
small businesses to receive a percentage of the total value of all prime- 
contract and subcontract awards for each fiscal year. The statutorily- 
mandated goal for SDVOSB participation is not less than 3 percent 26 of all 
federal contract dollars awarded each fiscal year. 27 SBA stated in its most 
recent report that, in fiscal year 201 0, $1 0.8 billion in small-business 
obligations were awarded to firms that self-certified themselves in the 
CCR as SDVOSBs. 28 DOD SDVOSB contracts accounted for $5.3 billion 
or 49 percent of government-wide SDVOSB contracts during fiscal year 
2010, 29 and VA SDVOSB contracts accounted for $3.2 billion, or 30 
percent during the same period. 30 Figure 1 summarizes the federal 
contracts awarded in fiscal year 2010 by federal agencies. 



^ 4 38 U.S.C. § 8127(g). 

25 Government-wide, all prospective federal contractors must certify whether they are 
delinquent on certain federal tax debts. However, such delinquency may not result in an 
automatic disqualification from contracting eligibility, as it does in VA's VetBiz eligibility. 

26 The federal government as a whole failed to reach the 3 percent goal in fiscal year 2010. 

27 Veterans Entrepreneurship and Small Business Development Act of 1999, Pub. L. No. 
106-50, § 502, 113 Stat. 233, 247-248 (codified at 15 U.S.C § 644 (g)(1)). 

28 SBA calculates its SDVOSB total by including all small-business dollars awarded to 
SDVOSBs, not just those received through set-aside or sole-source contracts. 

29 ln 2012, DOD OIG reported that DOD contracting personnel incorrectly coded 137 fiscal 
year 201 contracts, valued at approximately $1 .3 billion, as SDVOSB awards. 

30 ln 201 1 , VA OIG reported that total fiscal year 2010 SDVOSB and VOSB procurement 
dollars may actually be lower than reported by VA. 
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Figure 1: Federal Contracts Awarded to SDVOSBs in Fiscal Year 2010 
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Source: GAO analysis of SBA Goalina Report Data. 



Since 2009, GAO has issued nine reports or testimonies on the SDVOSB 
program, focusing on its vulnerability to fraud and abuse, and agencies' 
actions to prevent contracts from going to firms that misrepresent 
themselves as SDVOSBs. 31 When discussing the SDVOSB program, we 
have shown that a well-designed fraud-prevention system should consist 
of three crucial elements: (1) up-front preventive controls, (2) detection 
and monitoring, and (3) investigations and prosecutions. Figure 2 below 
outlines the key aspects of an effective fraud-prevention framework. 



See the list of related GAO products at the end of this report. 
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Figure 2: GAO's Fraud-Prevention Framework 
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The most effective and most efficient part of a fraud-prevention 
framework involves the institution of rigorous controls at the beginning of 
the process. At a minimum, preventive controls for the SDVOSB program 
should be designed to verify that a firm seeking SDVOSB status is eligible 
for the program. Even with effective prevention controls, there is residual 
risk that firms that appeared to meet SDVOSB program requirements 
initially will violate program rules once they obtain contracts. This fact 
makes effective monitoring and detection controls essential in a robust 
fraud-prevention framework. Detection and monitoring efforts include 
activities such as periodic reviews of suspicious firms and evaluating 
firms to provide reasonable assurance that they continue to meet 
program requirements. Finally, fraud-prevention controls are not fully 
effective unless identified fraud is aggressively prosecuted or companies 
are suspended, debarred, or otherwise held accountable, or both. 
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VA has made numerous conflicting statements about its progress 
verifying firms listed in VetBiz under the more-thorough process the 
agency implemented in response to the 2010 Act. These statements 
indicate that VA has taken an inconsistent approach to prioritizing the 
verification of firms and has been unable to accurately track the status of 
its efforts. Specifically, at the close of our audit work, documentation 
provided by VA indicated that thousands of SDVOSBs listed as eligible in 
VetBiz received millions of dollars in SDVOSB sole-source and set-aside 
contract obligations even though they had not been verified under the 
more-thorough process implemented in response to the 2010 Act. At that 
time, VA told us it planned to remove all firms that had their 1-year 
verification period expired and had not provided documentation for 
reverification under the 2010 Act process. Since then, on June 27, 2012, 
VA implemented an interim final rule that extends the eligibility of verified 
firms to 2 years, including firms for which the eligibility period had expired 
but that had not yet been reverified. Extending the eligibility period may 
allow VA to focus its efforts on more thoroughly verifying firms that were 
previously verified under VA's less-stringent 2006 Act process. However, 
the extension also allows thousands of firms to continue to be eligible for 
contracts even though they have not undergone the more-thorough 
process. With regard to our previous work, VA has taken some positive 
action to enhance its fraud prevention efforts by establishing processes in 
response to 6 of 1 3 recommendations we issued in October 201 1 . VA has 
also begun action on some remaining recommendations. 



VA Has Difficulty Tracking VA has provided a number of conflicting statements and explanations 
Its Inventory of Firms related to the status of its verification program, indicating that it is having 

difficulty tracking its inventory of firms and whether they were verified 
under the process implemented to carry out the 2010 Act. As we 
previously stated, the process VA implemented to review firms under the 
2006 Act consisted of checking whether a firm's owner was listed in VA's 
database of service-disabled veterans and conducting searches on 
publicly available websites such as the EPLS, which lists firms that have 
been debarred from doing business with the federal government. In 
contrast, VA stated that it implemented a more-thorough verification 
process under the 201 Act that included unannounced and announced 
site visits and a review and analysis of company documentation. 

Although the 2010 Act did not include a date by which VA must complete 
the verification of firms, within 60 days of the law's enactment VA was 
required to notify all unverified firms listed in its VetBiz database about 
the need to apply for verification by submitting documents to establish 
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veteran ownership and control. Firms were required to do so within 90 
days of receipt of the notification in order to avoid removal of the firm from 
VetBiz. VA officials told us that the agency prioritized its verification under 
the process implemented in response to the 2010 Act by reviewing (1) 
new applications for firms that had previously only self-certified in VetBiz 
(i.e., firms that had not been reviewed under the processes VA created 
for the 2006 Act or 201 Act); (2) new firms that had initially applied for 
verification after the 2010 Act, to include reprocessing any firms that were 
denied through the new requirements and subsequently requested 
reconsideration; and (3) applications for firms initially verified in VetBiz 
under the process VA chose to implement for the 2006 Act. 

However, our review of information provided by VA raises concerns about 
the status of this process and whether VA knows how many of its firms 
have actually been verified under the processes implemented in response 
to the 2010 Act. In one communication, VA stated that as of February 
201 1, VA's 2006 Act verification process had been discontinued, and all 
new verifications would use the process implemented in response to the 
2010 Act going forward. Because firms would need to reverify 1 year 
later, this meant that only firms verified under the 2010 Act process 
should have been in VetBiz as of February 2012. In November 201 1 , VA 
reported that it had removed all unverified firms from its database on 
September 4, 201 1 . Subsequently, while reviewing new cases involving 
firms that had received VA SDVOSB contracts, we found instances where 
firms were not verified under VA's 201 Act process, but rather were 
verified under its 2006 Act process. 32 

When we met with VA in February 2012 to discuss our new cases, 
officials confirmed that there were still firms in VetBiz that had not been 
through the processes implemented in response to the 2010 Act, but did 
not explain how many firms still had not gone through the new process. 
Then, on April 23, 2012, officials told us that they had recently removed 
thousands of firms from VetBiz because these firms had not supplied the 
supporting documentation that VA decided was required for verification 
under the process implemented in response to the 2010 Act; VA indicated 
that it planned to remove hundreds of additional firms for the same 
reason. VA has provided conflicting statements about whether these firms 



In one of our cases, firms that were in fact ineligible for the program received 
approximately $16 million in VA SDVOSB set-aside and sole-source contract obligations, 
$251 ,000 of which were new obligations, from October 201 to December 201 1 . 
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received the December 201 request to supply documentation. Further, 
over the next month, VA officials provided us with at least seven differing 
accounts of the number of SDVOSBs verified under the processes 
implemented for the 2006 Act and 2010 Act, the number of SDVOSBs 
they planned to remove, and the timing of the removals. VA's conflicting 
statements create uncertainty about the status of the agency's efforts to 
verify firms under the process implemented for the 2010 Act. Without a 
clear inventory and methods designed to track the verification process 
firms have undergone, VA cannot provide reasonable assurance that all 
firms appearing in VetBiz have been verified as owned and controlled by 
a veteran or service-disabled veteran. 

In its agency comments, VA explained these inventory issues by noting 
(1) the lack of a comprehensive case-management system has created 
the need for aggregate workarounds and resulted in inconsistent 
aggregate reporting; (2) the limitations of its current case-management 
system make it difficult to track the inventory of firms; and (3) as the 
limitations of the case-management system increase over time, the 
potential of CVE to lose track of how many firms have been verified also 
increases. VA also noted that its verification priorities have evolved over 
time. 

As of the close of our audit work, the information provided by VA 
indicated that thousands of potentially ineligible firms remain listed in 
VetBiz because they have not been verified under the more thorough 
process implemented for the 201 Act. Our analysis shows that as of 
April 1, 2012, 3,717 of the 6,178 SDVOSBs (60 percent) listed as eligible 
in VetBiz had yet to be verified using the more-thorough verification 
process. Of these 3,717 firms listed as eligible on April 1, 2012, 134 
received a total of $90 million in new VA SDVOSB sole-source or set- 
aside contract obligations during the 4-month period from November 30, 
201 1, to April 1 , 201 2. 33 On May 14, 2012, VA told us that it removed 
1 ,857 of these 3,71 7 SDVOSBs from April 2 to April 1 0, 2012, so that 
they are no longer eligible for VA SDVOSB sole-source and set-aside 
contracts. According to VA, the remaining 1,860 firms that had not 
received a review under the 2010 Act process were projected to be 
removed in July 2012 unless the firms provided adequate documentation 
supporting their eligibility. VA also stated that these firms were identified 



33 We did not investigate these 1 34 firms to determine if they were in fact ineligible. 
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as being in "reverification" and no such expired firm was eligible for an 
actual contract award until the reverification decision had been 
completed. 

Since then, on June 27, VA implemented an interim final rule that extends 
the eligibility of verified firms to 2 years. VA told us it interprets "verified" 
to include any firm that has been verified under either its 2006 or 201 
Act processes. Therefore, according to the interim rule, as long as a firm 
is verified under either process and is in its 2-year eligibility period, VA is 
only authorized to initiate a verification examination if it receives credible 
evidence calling into question a participant's eligibility. Furthermore, VA 
considered firms whose prior 1-year eligibility period had recently expired, 
but who had not yet been through reverification, to be within the scope of 
the new rule, thus extending their eligibility another year. Extending the 
eligibility period may allow VA to focus its efforts on more thoroughly 
verifying firms that were previously verified under its less-stringent 2006 
Act process. However, the extension also allows thousands of firms to 
continue to be eligible for contracts even though they have not undergone 
the more-thorough process. For example, according to information 
provided by VA in its comments, as of July 13, 2012, there are 6,079 
SDVOSBs and VOSBs listed in VetBiz. Of these, 3,724 were verified 
under the more-through process implemented under the 2010 Act and 
2,355 — over 38 percent-were verified under VA's less-rigorous 2006 Act 
process. As VA acknowledges in its agency comments, "the retention of 
firms verified prior to the 2010 Act [process] increases the possibility 
awards will go to firms that will not be verified when the more rigorous 
process is applied." 

Moreover, past audits show the risk of providing SDVOSB contracts to 
firms reviewed under VA's 2006 Act process. For example, in 201 1 , VA's 
own OIG issued a report that reviewed both SDVOSBs and VOSBs listed 
in VetBiz and found that 10 of 14 SDVOSBs and VOSBs verified under 
VA's 2006 Act process and listed as eligible were in fact ineligible for 
these respective programs. The report identified several reasons for why 
these firms were ineligible, including improper subcontracting practices, 
lack of control and ownership, and improper use of SDVOSB status, 
among others. Further, the report noted VA's document-review process 
under the 2006 Act "in many cases was insufficient to establish control 
and ownership... [and] in effect allowed businesses to self-certify as a 
veteran-owned or service-disabled veteran-owned small business with 
little supporting documentation." The report goes on to state that VA's 
failure to maintain "accurate and current" information in the VetBiz 
database also exacerbated problems in the verification process. VA's OIG 
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also used statistical sampling methods to project that (1) $500 million of 
VA SDVOSB and VOSB contracts were awarded annually to ineligible 
firms and (2) VA will award about $2.5 billion in SDVOSB and VOSB 
contracts to ineligible firms over the next 5 years if it does not strengthen 
its oversight and verification procedures. 



In October 201 1 , we issued 1 3 recommendations to VA related to 
vulnerabilities in the verification process implemented by VA after the 
2010 Act; VA generally concurred with our recommendations. As of June 
2012, VA has provided us with documentation demonstrating that it has 
established procedures in response to 6 of these recommendations. 
Figure 3 shows the status of the recommendations; more specific 
information on each recommendation follows the figure. We have not 
assessed the effectiveness of any of the procedures that VA has 
established thus far as this is beyond the scope of this report. 



VA Has Made Some 
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Figure 3: Status of GAO's Previous Recommendations 



Fraud-prevention 
controls 


GAO recommendations 


Status as of 
June 2012 


Preventive 


Provide regular fraud-awareness training to CVE and VA contracting personnel 


o 




Provide additional guidance and training to the VA contracting personnel on the use 
of the VetBiz website so that SDVOSB contracts are only awarded to verified firms 


• 




Establish formal procedures for VA staff to refer suspicious applications to the 01 G 
and provide guidance on what type of cases to refer to the OIG 


• 




Explore the feasibility of validating applicants' information with third parties, for example, 
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assess the accuracy of the information provided 


• 




Formalize a process for conducting unannounced site visits to firms identified as high 
risk during the verification process 


• 


Detection and 
Monitoring 


Develop and implement procedures for conducting unannounced site visits to contract 
performance locations and interviews with contracting officials to better assess whether 
verified companies comply with program rules after verification 


o 




Develop and implement a process for unannounced site visits to verified companies' 
offices to obtain greater effectiveness and consistency in the verification program 


• 




Develop procedures for risk- based periodic reviews of verified firms receiving contracts 
to assess compliance with NAICS size standards and SDVOSB program rules 


o 


Investigations and 
Prosecutions 


Develop and implement specific processes and criteria for the Debarment Committee 
on compliance with the requirement in the 2006 Act to debar, for a reasonable period 
of time, firms and related parties that misrepresent their SDVOSB status 


o 




Develop and implement specific procedures and criteria for staff to make referrals to 
VA's Debarment Committee and VA's OIG as a result of misrepresentations identified 
during initial verification and periodic reviews 


• 




Develop specific guidelines outlining the Debarment Committee's decision process 
to debar firms that misrepresent their SDVOSB status 


o 




Develop procedures on removing SDVOSB contracts from ineligible firms 


o 




Formalize procedures to advertise debarments and prosecutions 


o 



£ Process established 
Q Process not established 



Source: GAO and analysis of VA data 
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Process Established • VA has provided additional guidance and training to the VA 

contracting personnel on the use of the VetBiz website. In 

December 201 1 , VA issued a guidance memo requiring VA 
contracting personnel to check VetBiz to ensure that a firm is verified 
both upon receipt of an offer and prior to award. In November 201 1 , 
VA also provided training to the contracting personnel on the use of 
VetBiz. Providing guidance and training to current and new 
contracting personnel will help to ensure that these staff are aware of 
the need to check VetBiz prior to awarding a contract. 

• VA has established formal procedures for VA staff to refer 
suspicious applications to the OIG and provided guidance on 
what type of cases to refer to the OIG. In April 2012, VA issued 
procedures for VA staff to use if they identify suspicious information or 
possible misrepresentations on an application for eligibility during their 
initial review process. These procedures contain step-by-step 
instructions for how to notify the OIG about suspicious applications. 
Specifically, CVE's "risk team" makes a determination as to whether 
or not an applicant has intentionally misrepresented its status in an 
apparent attempt to defraud the government. If the information is 
credible, the applicant is referred to the VA OIG. If VA OIG accepts 
the referral, it conducts preliminary inquiries to determine whether a 
full investigation into criminal activity is warranted. If the OIG declines 
the investigation, VA can refer the matter to VA's Debarment 
Committee, which VA instituted in September 2010 specifically to 
debar firms that had violated SDVOSB regulations. In addition to 
these procedures, from November 2011 through January 2012, VA 
provided three training sessions to the VA staff on the type of red 
flags to note during the application review. 

• VA has explored the feasibility of validating applicants' 
information with third parties. In 2012, VA met with Dun and 
Bradstreet 34 to explore the feasibility of utilizing their services to 
validate applicants' information, such as names and titles of business 
owners. Validating applicants' information with third parties may help 
enhance VA's ability to assess the accuracy of self-reported 
information. 



Dun and Bradstreet is a public company that licenses information on businesses and 
corporations. 
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• VA has formalized a process for conducting unannounced site 
visits to firms identified as high-risk during the verification 
process. In June 2012, VA issued procedures for VA to conduct 
unannounced site visits on a sample of 50 percent of high-risk firms 
identified during the verification process. Formalizing this process with 
a focus on high-risk firms may help provide reasonable assurance that 
only eligible firms gained access to the VetBiz database. 

• VA has developed and implemented a process for unannounced 
site visits to verified companies to obtain greater effectiveness 
and consistency in the verification process. VA's aforementioned 
June 2012 procedures also apply to verified companies. VA 
developed a process to select on a weekly basis, based on a 
combination of random and risk-based factors, verified firms to 
receive an unannounced site visit. In addition, according to VA it has 
started making these unannounced site visits. Conducting these site 
visits may help provide reasonable assurance to VA that the 
verification process is effective. 

• VA has developed and implemented specific procedures and 
criteria for staff to make referrals to the Debarment Committee 
and VA OIG as a result of misrepresentations identified during 
initial verification and periodic reviews. VA's aforementioned April 
2012 procedures also apply to false information or misrepresentations 
identified after VA's initial review of the application, during the firm's 
eligibility period. These procedures may increase VA's success in 
pursuing firms that have misrepresented their eligibility for the 
program. 

Process Not Established • VA has not provided regular fraud-awareness training to CVE 

and VA contracting personnel. One of the most significant 
challenges to an effective verification program is to have sufficient 
human capital with proper training and experience. Although VA has 
not established regular fraud-awareness training, it has made 
progress in this area. For example, VA told us that its OIG recently 
provided training on procurement fraud and that its General Counsel 
provides weekly training on examination procedures and policies in 
order to educate staff on fraud prevention. In addition, VA said that it 
has plans to require all CVE staff to attend a fraud examiners course; 
several CVE staff were already scheduled to attend fraud training in 
July 2012. Having sufficient human capital with the proper training and 
experience would enhance the effectiveness of the verification 
program. 
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• VA has not developed and implemented procedures for 
conducting unannounced site visits to contract performance 
locations and interviews with contracting officials to better 
assess whether verified companies comply with program rules 
after verification. VA has started conducting announced site visits as 
part of its subcontracting compliance review program. This program is 
used to determine if a firm is performing in accordance with 
percentage of work performance requirements and other 
subcontracting commitments. However, VA has not developed and 
implemented procedures for conducting unannounced site visits to 
contract performance locations and interviews with contracting 
officials. The unannounced site visits and interviews with contracting 
officials would allow VA to better assess whether verified firms comply 
with program rules after verification. 

• VA has not developed procedures for risk-based periodic 
reviews of verified firms receiving contracts to assess 
compliance with North American Industry Classification System 
(NAICS) 35 size standards and SDVOSB program rules. In order to 
be eligible for SDVOSB set-aside and sole-source contracts, a firm 
must qualify as a small business under NAICS size standards. In draft 
guidelines, VA included supplemental information for VA staff to 
review the firm's NAICS codes size standards, but these guidelines 
have yet to be finalized. Moreover, the draft guidelines do not include 
procedures for periodic reviews of verified firms' compliance with 
these standards. Such procedures would help improve continued 
compliance with SDVOSB program rules. 

• VA has not developed and implemented specific processes and 
criteria for the Debarment Committee on compliance with the 
requirement in the 2006 Act to debar, for a reasonable period, 
firms and related parties that misrepresent their SDVOSB status. 

According to VA, its Debarment Committee relies on procedures 
outlined in the FAR and the VA Acquisition Regulations to determine 
the length of debarments. 

• VA has not developed specific guidelines outlining the 
Debarment Committee's decision process to debar firms that 



35 The NAICS is the standard used by federal statistical agencies in classifying business 
establishments for the purpose of collecting, analyzing, and publishing statistical data 
related to the U.S. business economy. 
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misrepresent their SDVOSB status. VA should provide the 
Debarment Committee with guidelines to aid its decision-making 
process in determining what constitutes a "misrepresentation" 
deserving of debarment, as that term is used in the 2006 Act. 

• VA has not developed procedures on removing SDVOSB 
contracts from ineligible firms. According to the VA Acquisition 
Regulations, the Deputy Senior Procurement Executive has the 
authority to determine whether VA should terminate a contract with a 
debarred firm. However, VA has not developed procedures to remove 
SDVOSB contracts from ineligible firms. According to VA, it is in the 
process of developing a policy on removing SDVOSB contracts from 
ineligible firms as determined by status protests. In addition, VA is in 
the process of providing guidance to the acquisition workforce on 
removing SDVOSB contracts from ineligible firms. Until VA develops 
procedures on removing SDVOSB contracts from ineligible firms, the 
SDVOSB program is at risk for ineligible firms to abuse the program 
and retain contracts obtained through fraud and abuse. 

• VA has not formalized procedures to advertise debarments and 
prosecutions. VA has not formalized procedures for advertising 
debarments and prosecutions, though the Debarment Committee, the 
OIG, and CVE have listed these actions on their websites. 



No Action Has Been 
Taken to Improve 
Government-wide 
SDVOSB Fraud- 
Prevention Controls 



No action has been taken to improve government-wide SDVOSB fraud- 
prevention controls as the program continues to remain a self-certification 
program. Because federal law does not require it, SBA does not verify 
firms' eligibility status, nor does it require that firms submit supporting 
documentation. According to SBA, it is only authorized to perform 
eligibility reviews in a protest situation, including those cases where SBA 
itself has reason to believe that a firm misrepresented its SDVOSB status. 
However, without basic checks on firms' eligibility claims, SBA cannot 
provide reasonable assurance that legitimate SDVOSBs are receiving 
government contracts. In fact, five of our new case-study firms received 
SDVOSB set-aside and sole-source contract obligations, totaling 
approximately $190 million, of which $75 million were new SDVOSB set- 
aside and sole-source contract obligations, from October 1 , 2009, to 
December 31 , 201 1 , despite evidence indicating they are ineligible for the 
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program. 36 With regard to our original 10 case-study firms reported in 
October 2009, some are under investigation by SBA OIG and punitive 
actions have been taken against others. To address vulnerabilities in the 
government-wide program, we previously suggested that Congress 
consider providing VA with the authority necessary to expand its 
SDVOSB eligibility verification process government-wide. Such an action 
is supported by the fact that VA maintains the database identifying which 
individuals are service-disabled veterans and is consistent with VA's 
mission of service to veterans. However, such action should not be 
undertaken until VA demonstrates that its verification process is 
successful in reducing the SDVOSB program's vulnerability to fraud and 
abuse. 



In our previous work, we found that the SDVOSB program did not have 
effective government-wide fraud-prevention controls in place and was 
vulnerable to fraud and abuse. 37 Outside of VA, there was no verification 
in place for SDVOSB contracting. Because federal law does not require it, 
SBA and agencies awarding contracts — other than VA — do not have a 
process in place to validate a firm's eligibility for the program, and rely on 
the firms self-certifying as a service-disabled veteran-owned business in 
CCR. We found the only process in place to detect fraud in the 
government-wide SDVSOB program involved a formal bid-protest 
process at SBA, whereby interested parties to a contract award could 
protest another firm's SDVOSB eligibility or small-business size. 
However, we reported that this self-policing process did not prevent 
ineligible firms from receiving SDVOSB contracts. SBA officials have told 
us that they have limited responsibility over the SDVOSB program, and 
that the agency's only statutory obligation is to report on other agencies' 
success in meeting SDVOSB contracting goals. 

Our new case studies highlight instances of the fraud and abuse that 
resulted from the lack of verification of firms' SDVOSB status. In fact, five 
of our new case-study firms received SDVOSB set-aside and sole-source 
contract obligations, totaling approximately $190 million from October 1, 



The SDVOSB contract dollars reported include the four cases for which we were able to 
substantiate allegations of program ineligibility and one case for which we gathered 
enough evidence to indicate the case may be ineligible. 

37 GAO-10-108. 
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2009, to December 31 , 201 1 , despite evidence indicating they are 
ineligible for the program. Of this $190 million, $75 million were new 
SDVOSB set-aside and sole-source contract obligations. In four of the 
cases we examined, we were able to substantiate informants' allegations 
of ineligibility as follows: 

• Non-SDVOSB joint venture. An SDVOSB entered a joint venture 
with a non-SDVOSB firm and received about $16 million in new 
government-wide SDVOSB set-aside contract obligations. Such joint 
ventures are eligible if the SDVOSB firm manages the joint venture 
and the contract work. However, the owner, a service-disabled 
veteran, admitted to our investigators that his SDVOSB firm did not 
manage the joint venture. Therefore, the joint venture is ineligible. 
This firm is currently listed as a SDVOSB in CCR, which allows the 
firm to compete for government-wide SDVOSB contracts. 

. VA-denied firm. Though VA denied a firm SDVOSB status in 2010 
because the firm was not controlled by a service-disabled veteran 
owner, the firm continued to self-certify in CCR. A VA site visit found 
the service-disabled veteran worked mostly at another company, and 
the non-service-disabled veteran vice president controlled the firm. In 
201 1 , when the firm applied for VA verification again, the size of the 
firm was also questioned as it shared ownership or management with 
at least four different entities, including companies owned by a non- 
service-disabled veteran minority owner. The company withdrew its 
application to be a VA verified SDVOSB. In total, the firm received 
about $21 million in SDVOSB set-aside and sole-source contracts 
from DOD, the General Services Administration (GSA), the 
Department of the Interior (DOI), the U.S. Department of Agriculture 
and the VA, $16 million of which were new SDVOSB set-aside and 
sole-source contract obligations. After VA denied the firm, the firm 
continued to self-certify as a SDVOSB in CCR and GSA, and DOI 
awarded the firm about $860,000 in new SDVOSB set-aside contracts 
obligations. This firm is currently listed as a SDVOSB in CCR, which 
allows the firm to compete for government-wide SDVOSB contracts. 

• Multiple firms not veteran-controlled. A service-disabled veteran 
and two non-service disabled veteran co-owners owned two firms and 
a joint venture at the same location. VA found one of the firms 
ineligible. The operating agreements of two of the firms allowed the 
two minority owners to control the firms, rather than the service- 
disabled veteran. Additionally, the joint venture, created by one of the 
firms, was also ineligible because the service-disabled veteran's firm 
did not manage the joint venture and the contract work. Therefore, 
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none of the three firms were eligible for the SDVOSB program. The 
three firms received over $91 million in SDVOSB set-aside and sole- 
source contract obligations, about $18 million of which were new 
SDVOSB set-aside and sole- source contract obligations, from VA 
and the Department of Health and Human Services. The three firms 
have been removed from VA VetBiz. However, these firms are 
currently listed as SDVOSBs in CCR, which allows the firms to 
compete for government-wide SDVOSB contracts. 

• Not service-disabled veteran-controlled. This firm is ineligible for 
the SDVOSB program because the veteran does not control the daily 
operations. The service-disabled veteran was not the Chief Executive 
Officer, and the firm's operating agreement did not give the service- 
disabled veteran the exclusivity to make decisions for the company. In 
addition, the service-disabled veteran owner lived 500 miles away 
from the firm, received only $12,000 compared to the non-service- 
disabled veteran minority owner's $88,000 salary, and failed to meet 
or communicate with subcontractors. This firm received about $37 
million in SDVOSB set-aside contract obligations, $446,000 of which 
were new SDVOSB set-aside contract obligations, from DOD and 
DOI. During the course of our work, SBA and VA found this company 
ineligible for the SDVOSB program. This firm no longer self-certifies 
as a SDVOSB in CCR. On May 25, 2012, SBA debarred the non- 
service-disabled veteran and the firm, making them ineligible for 
further contracts with the federal government. 

We were unable to substantiate allegations in a fifth case, but found 
evidence that the firm in question may be ineligible for the SDVOSB 
program because the service-disabled veteran owner may not spend 
sufficient time at the SDVOSB. The service-disabled veteran owner 
worked as an attorney at a legal services organization Monday through 
Friday about 40 hours a week, which could prevent the veteran from 
managing the day-to-day proceedings of the SDVOSB. This firm received 
about $25 million in new SDVOSB set-aside and sole-source contract 
obligations from VA and the Department of Transportation. This firm is 
now listed as verified in VetBiz and is currently listed as a SDVOSB in 
CCR, which allows the firm to compete for government-wide SDVOSB 
contracts. 

The DOD OIG likewise reported that DOD, which awarded about half of 
government-wide SDVOSB contracts in 2010, did not require adequate 
verification of contractor status before awarding contracts. After its review 
of DOD contracts awarded from October 2009 to July 2010, the OIG 
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reported that $1 .9 million in SDVOSB contracts went to firms that were 
not registered in CCR as SDVOSBs and $340.3 million went to 
contractors that potentially misstated their SDVOSB status. 38 The OIG 
also found that DOD awarded 12 SDVOSB set-aside and sole-source 
contracts for a total of $1 1 .5 million to six firms that VA rejected. The OIG 
went on to recommend that DOD create an SDVOSB verification 
program, but the agency disagreed, citing an absence of evidence 
indicating that such a program would produce a net benefit to eligible 
SDVOSBs, and that Congress had not provided DOD with either the 
resources or authority to establish such a system. 

To address the vulnerabilities within the government-wide program 
caused by reliance on a self-certification process, we suggested in 2009 
that Congress consider providing VA with the authority and resources 
necessary to expand its SDVOSB eligibility verification process to all 
contractors seeking to bid on SDVOSB contracts government-wide. Such 
an action is supported by the fact that VA maintains the database 
identifying which individuals are service-disabled veterans and is 
consistent with VA's mission of service to veterans. In 201 1 , legislation 
was also introduced and passed in the Senate requiring all agencies to 
use VA's VetBiz for SDVOSB contract awards; this legislation has not 
become law. However, as shown by our current work, VA's program 
remains vulnerable to fraud and abuse because the agency has been 
unable to accurately track the status of its efforts and because potentially 
ineligible firms remain listed in VetBiz. Consequently, VA's ability to show 
that its process is successful in reducing the SDVOSBs program's 
vulnerability to fraud and abuse remains an important factor in any 
consideration about the potential expansion of VA's eligibility verification 
process government-wide. GAO has ongoing work that will, in part, 
examine some of the key issues that need to be addressed if VA's 
verification program were to be implemented government-wide. 



Actions Taken against In 2009, we found that ineligible firms in 10 cases received $100 million in 

Ineligible Firms SDVOSB contracts and $300 million in other federal contracts. 39 We 



DOD OIG, Inadequate Controls Over the DOD Service-Disabled Veteran-Owned Small 
Business Set-Aside Program Allow Ineligible Contractors to Receive Contracts, 2012-059 
(Feb. 29, 2012). 

39 GAO-10-108. 
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referred all 10 of these cases to the appropriate agency OIGs. As of April 
2012, while none of the firms are currently suspended or debarred by the 
agencies that received our referrals, 40 some actions have been taken: 

• The SBA OIG is proceeding with six open investigations. In addition, 
the SBA OIG has joined forces with other agency OIGs to pursue 
several cases. Specific details cannot be provided until the cases 
have been fully adjudicated. 

• One individual related to a case is being prosecuted by the U.S. 
Attorney for wire fraud and fraud against the United States involving a 
contract valued at $1 million or more related to its misrepresentation 
as an SDVOSB. In addition, this individual and a related firm were 
suspended by the Department of Transportation for procurement 
fraud. 

• One individual related to a case-study is being charged by the U.S. 
Attorney with conspiracy to commit wire fraud and forfeiture of his 
assets up to $400,000. This individual allegedly conspired to defraud 
the SBA and other government contractors by falsely representing his 
business as a service-disabled veteran-owned and operated 
business. 

• Another case-study firm pled guilty to wire fraud in relation to 
fraudulently receiving Historically Underutilized Business Zone 
(HUBZone) federal contracts. 41 Our previous finding that the case was 
ineligible for the SDVOSB program, in conjunction with the firm's 
admitting defrauding the HUBZone program, raises the concern of 
ineligible firms applying for multiple procurement programs. 

Actions taken against firms that violate the SDVOSB program 
requirements should help protect the government's interest and help 
discourage ineligible firms from abusing the SDVOSB program. As 
previously discussed, providing more emphasis on debarments and 



In 201 1 , GAO reported that SBA suspended four companies and three individuals 
associated with 2 of the 10 case-studies. Since then these suspensions have expired. 

41 The HUBZone program was established to provide federal contracting preferences to 
small businesses operating in economically distressed communities. 
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investigations could further help the government deter firms from 
attempting to fraudulently gain access to the SDVOSB program. 



The SDVOSB program has provided billions of dollars in contracting 
opportunities to deserving service-disabled veterans. However, our body 
of work, along with work by the DOD OIG and VA OIG, has found that the 
program is vulnerable to fraud and abuse, which has allowed millions of 
dollars to be awarded to ineligible firms. The government-wide program 
remains particularly vulnerable since it relies on an honor-system-like 
process whereby firms self-certify their eligibility. VA has the only program 
within the government dedicated to verifying SDVOSB firms' eligibility; VA 
also has responsibility for maintaining a database of service-disabled 
veterans and a listing of firms that are eligible for the SDVOSB program. 
Given VA's mission of service to veterans, we previously suggested that 
Congress consider expanding VA's program government-wide to employ 
more effective fraud-prevention controls over the billions of dollars 
awarded to SDVOSBs outside of VA. However, such action should not be 
undertaken until VA demonstrates that its verification process is 
successful in reducing the SDVOSB program's vulnerability to fraud and 
abuse. 



Furthermore, while the results of this most-recent assessment show that 
VA has made some progress in improving its verification process in 
response to the 2010 Act, it has made conflicting statements regarding 
the verification of firms and has been unable to accurately track the status 
of its efforts. These problems have resulted in thousands of potentially 
ineligible SDVOSBs receiving millions of dollars in sole-source and set- 
aside contract obligations. By better managing its inventory of firms, 
maintaining the accuracy of firms' status in VetBiz, and applying the 2010 
Act verification process to all firms, VA can be more confident that the 
billions of dollars meant to provide VA contracting opportunities to our 
nation's service-disabled veteran entrepreneurs make it to the intended 
beneficiaries. 



Recommendations for ^° m ' n ' m ' ze potential fraud and abuse in VA's SDVOSB program and 

provide reasonable assurance that legitimate SDVOSB firms obtain the 

Executive Action benefits of this program, we recommend that the Secretary of Veterans 

Affairs ensure that all firms within VetBiz have undergone its 2010 Act 
verification process. Specifically, this should include consideration of the 
following three actions: (1) inventory firms listed in VetBiz to establish a 
reliable beginning point for the verification status of each firm; (2) 
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establish procedures to maintain the accuracy of the status of all firms 
listed in VetBiz, including which verification process they have undergone; 
and (3) expeditiously verify all current VetBiz firms and new applicants 
under the 2010 Act verification procedures. 



Agency Comments 
and Our Evaluation 



We provided a draft of our report to VA and SBA for comment. In its 
written comments, reproduced in appendix I, VA stated that it concurred 
with our first two recommendations. It concurred "in principle" with the 
third, to verify all current VetBiz firms and new applicants under the 
processes implemented under the 2010 Act. With respect to this 
recommendation, VA noted that it implemented an interim rule on June 
27, 2012, that extends the eligibility of verified firms to 2 years. VA told us 
it interprets "verified" to include any firm that has been verified under 
either its 2006 or 2010 Act processes. Therefore, according to the interim 
final rule, as long as a firm is verified under either process and is in its 2- 
year eligibility period, VA is only authorized to initiate a verification 
examination if it receives credible evidence calling into question a 
participant's eligibility. Extending the eligibility period may allow VA to 
focus its efforts on more thoroughly verifying firms that were previously 
verified under its less-stringent 2006 Act process. However, the extension 
also allows thousands of firms to continue to be eligible for contracts even 
though they have not undergone the more thorough process. We 
acknowledge that VA has latitude under the law to modify its own 
regulations as necessary. However, the interim final rule in effect 
removes a backlog of firms and appears to be a self-created impediment 
delaying verification under the 201 Act process. We remain convinced 
that the verification process utilized by VA prior to the 2010 Act process 
does not provide reasonable assurance that only eligible SDVOSBs 
participate in the program. Given this ongoing vulnerability to fraud and 
abuse, we continue to believe that VA should expeditiously verify current 
VetBiz firms and new applicants under the 2010 Act verification process. 



Despite these concurrences, VA commented that our report was 
misleading and inaccurate with respect to (1) our characterizations of a 
201 1 VA OIG report, (2) conflicting statements made by VA, and (3) VA's 
implementation of our previously issued recommendations. We disagree. 
First, VA stated that our use of the VA OIG's 201 1 report was misleading 
because the report examined a period when the VetBiz database 
included self-certified firms in addition to firms verified under the 
processes implemented under the 2006 Act. VA also claims the VA OIG 
report contains excessive extrapolations because it examined eligibility 
requirements beyond ownership and control. Specifically, VA notes that 
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14 of the 42 firms reviewed for the OIG report had been through the 
verification process VA used in response to the 2006 Act and claims that 
only 3 were determined to be ineligible based on ownership and control. 
VA's statement is incomplete and misleading. According to the OIG, an 
additional 7 were determined to be ineligible for reasons that could be 
identified during a robust verification process. As a result, the OIG found 
10 of 14 firms verified under VA's 2006 Act process to be ineligible — an 
eligibility failure rate comparable to the overall eligibility failure rate cited 
in the report. 

With regard to the aforementioned 7 firms, the OIG determined they were 
ineligible because they were engaged in improper subcontracting 
practices, such as "pass-through" contracts. Pass-through contracts occur 
when businesses or joint venture/partnerships list veterans or service 
disabled veterans as majority owners of the business but, contrary to 
programs requirements, the non-veteran owned business either 
performed or managed the majority of the work and received a majority of 
the contracts' funds. Given that the firms being reviewed by the OIG 
already had existing contracts in place, the OIG was able to identify the 
pass-through contracts by conducting site visits and reviewing business 
documentation, the same steps that VA claims are taken during the 
verification process it implemented in response to the 2010 Act. While we 
acknowledge that it is difficult to identify pass-through contracts for 
applicants to the program who don't have any preexisting contracts, VA 
should be conducting such a review for those firms that have contracts in 
place. As we have noted in past reports, VA's fraud prevention controls 
should include detection and monitoring measures to assure that firms 
are completing the work required of an SDVOSB contract. 

Second, VA disagrees that it provided numerous conflicting statements to 
us regarding its verification efforts, stating that the verification process 
has evolved and that VA faces technical limitations related to its case- 
management system. While we acknowledge these concerns, it is 
important to note that VA did not provide us with any explanation as to its 
evolving priorities during the course of our audit and instead repeatedly 
sent us contradictory information without any clarification. Moreover, not 
all of the conflicting statements VA made can be attributed to 
inadequacies in its case-management system or to evolving priorities. 
Specifically, the information we received during the course of our audit 
work changed so significantly over such a short period of time that the 
evidence GAO collected does not support VA's assertion that it "knows 
how many firms have been verified" and can "track individual firms," as 
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VA claims in its agency comment letter. Examples of the conflicting 
statements we received include the following: 

• Removal of firms: On April 23, 2012, VA told us that about 900 
SDVOSBs and VOSBs listed in VetBiz were targeted for removal 
because they had not been verified under the 2010 Act process. 
By April 27, 2012, this number increased to approximately 3,500 
SDVOSBs and VOSBs. On May 2, 2012, we received two more 
differing accounts of SDVOSBs and VOSBs targeted for removal- 
2,660 firms and 2,646 firms-in the same email. 

• Implementation of the 201 Act process: On February 1 6, 
2012, VA told us that it continued to verify firms under the process 
implemented under the 2006 Act between January and May 201 1 . 
Then, on April 23, 2012, VA told us that it stopped verifying firms 
under its 2006 Act process in February 201 1 and began 
verification under its 2010 Act process at the same time. Next, on 
May 12, 2012, VA told us that it stopped verifying firms under the 
2006 Act process in January 201 1 and began verifying under the 
201 Act at the end of December 201 0. In the same 
communication, VA told us that no firm was approved under its 
2006 Act process after February 2011. But on May 21, 2012, VA 
sent us a list of firms and verification dates showing that multiple 
firms were last verified under its 2006 Act process past February 
201 1 , with at least two firms verified under iits 2006 Act process 
as late as May 201 1. 

Finally, VA stated it believed all previous GAO recommendations issued 
in October 201 1 should be closed. For GAO to close a recommendation, 
it must be implemented or actions must have been taken that essentially 
meet the recommendation's intent. Further, the responsible agency must 
provide evidence, with sufficient supporting documentation, that the 
actions are being implemented adequately. By the end of our audit work, 
we were able to close 6 of the 13 recommendations that we issued to VA 
in October 2011 based on documentation VA provided demonstrating that 
the agency had taken specific actions in response to our 
recommendations. Although VA indicated that it would like to close out 
the remaining recommendations, it either did not demonstrate that it had 
taken an action to implement a recommendation or did not provide the 
supporting documentation needed to show that the recommendation was 
in fact implemented. We had several discussions with VA staff about our 
requirements for closing recommendations, the last occurring on June 22, 
2012. Moreover, we noted in our report any progress VA has made with 
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respect to each recommendation; the information VA provided in this 
letter had previously been acknowledged in our report. For the 7 
recommendations that remain open after the issuance of this report, we 
will continue to seek from VA additional documentation necessary to 
demonstrate that implementation has occurred. At such time, we will 
close each recommendation, as appropriate. 

In addition, VA provided technical comments, which we addressed as 
appropriate. We provide annotated responses to VA's more detailed 
comments in appendix I. 

In written comments received through e-mail, SBA stated that it is 
committed to eliminating fraud, waste, and abuse in all of its programs 
including the government-wide SDVOSB program. In addition, SBA 
stated that it maintains a "robust and thorough" protest and appeal 
process. However, as noted in our report, SBA's bid-protest process 
alone — that is, without upfront eligibility verification and other related 
measures — cannot provide reasonable assurance that only legitimate 
firms are awarded SDVOSB contracts. In addition, five new case studies 
developed for this report highlight instances of fraud and abuse. SBA 
disagreed with the draft report's portrayal of actions taken against the 
firms that were the subject of the 10 case studies developed as part of 
our October 2009 report. We revised our report where appropriate. SBA 
also stated that it had taken actions against firms in addition to those cited 
in our case studies, but did not provide specific examples. Finally, SBA 
stated that it was implementing training to help its staff identify fraud and 
abuse and working to improve its referral process and collaboration with 
other agencies. Such efforts could help reduce the SDVOSB program's 
vulnerability. However, these efforts would affect only SBA's investigation 
and prosecution efforts, and not prevention, detection, and monitoring. If 
the government-wide program included measures to prevent, detect, and 
monitor fraud in the SDVOSB program, SBA could be more confident that 
the billions of dollars meant to provide contracting opportunities to our 
service-disabled veteran entrepreneurs make it to the intended 
beneficiaries. 
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We are sending copies of this report to interested congressional 
committees, the Administrator of SBA, the Secretary of Veterans Affairs, 
and other interested parties. The report is also available at no charge on 
the GAO website at http://www.gao.gov. 

If you have any questions concerning this report, please contact Richard 
J. Hillman at (202) 512-6722 or hillmanr@gao.gov. Contact points for our 
Offices of Congressional Relations and Public Affairs may be found on 
the last page of this report. 




Richard J. Hillman 
Managing Director 

Forensic Audits and Investigative Service 
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Appendix I: Comments from the Department 
of Veterans Affairs 



Note: GAO comments 
supplementing those in 
the report text appear at 
the end of this appendix. 
Page numbers in the draft 
report may differ from 
those in this report. 




L-KPAKTMBNT OF VETERANS AFFAIRS 
Washington DC 20420 



July 19, 2012 



Mr. Gregory D. Kutz 
Director, Forensic Audits and 
Investigative Service 
U.S. Government Accountability Office 
441 G Street, NW 
Washington, DC 20548 

Dear Mr. Kutz: 

The Department of Veterans Affairs (VA) has reviewed the Government 
Accountability Office's (GAO) draft report, "SERVICE-DISABLED VETERAN-OWNED 
SMALL BUSINESS PROGRAM: Vulnerability to Fraud and Abuse Remains" 

(GAO-1 2-697). VA concurs with GAO's recommendations 1 and 2 and concurs in 
principle with recommendation 3 to the Department. 

Despite these concurrences, VA has serious concerns with specific language in 
this draft report. VA believes the inaccurate portrayal of information in a number of 
areas either misleads the reader or misrepresents the status of the Center for Veterans 
Enterprise verification program. The enclosures specifically address each of GAO's 
recommendations and provide extensive technical comments on the draft report. 

VA urges full incorporation of the recommended technical changes in order to 
ensure an accurate and reliable report. VA representatives are available to assist in 
further clarification of these issues upon request. Please contact Ms. Denese Canedo, 
at denese.canedo@va.gov or by telephone at 202-461-5684, should you have any 
further questions or desire to discuss these recommended technical changes. 

VA appreciates the opportunity to comment on your draft report. 



Sincerely, 




Chief of Staff 



Enclosures 
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Veterans Affairs 



Enclosure 

Department of Veterans Affairs (VA) Comments to 
Government Accountability Office (GAO) Draft Report: 
"SERVICE-DISABLED VETERAN-OWNED SMALL BUSINESS PROGRAM - 
Vulnerability to Fraud and Abuse Remains" 

(GAO-1 2-697) 



GAO Recommendation : To minimize potential fraud and abuse in VA's SDVOSB 
program and provide reasonable assurance that legitimate SDVOSB firms obtain the 
benefits of this program, we recommend that the Secretary of Veterans Affairs ensure 
that all firms within VetBiz have undergone its verification process. This should include 
consideration of the following three actions: 

Recommendation 1 : Inventory firms listed in VetBiz to establish a reliable beginning 
point for the verification status of each firm. 

VA Response: Concur. The Center for Veterans Enterprise (CVE) has a complete 
inventory of all firms listed in its Vendor Information Pages (VIP), located at the VetBiz 
Web site that identifies the status of each firm, its eligibility date, and whether it was 
verified under the processes established as a result of the 2010 
P.L. 1 1 1 -275. Please see Attachment A (Verification Master Inventory List (VMIL) for a 
complete inventory of firms, including verification status. VA is furnishing a CD as the 
list is more than 300 pages. 

Recommendation 2: Establish procedures to maintain the accuracy of the status of all 
firms listed in VetBiz, including which verification process they have undergone. 

VA Response: Concur. CVE has established procedures to maintain the accuracy of 
the status of all firms listed in VIP; however, due to limitations in the Verification Case 
Management System (VCMS) - the VA's information management system - the status 
of firms is maintained separately in the VMIL. The VMIL is updated as changes occur. 
CVE has initiated action to upgrade VCMS so that it can support current and future 
business processes. 

Recommendation 3: Expeditiously verify all current VetBiz firms and new applicants 
under the 2010 Act verification procedures. 

VA Response: Concur in Principle. All firms listed as verified in the VIP have been 
verified in accordance with P.L. 109-461 and 38 CFR §74. VA seeks to verify all firms 
using the process established as a result of 1 1 1-275; however, 38 CFR 74.15 (c) only 
authorizes CVE to initiate a verification examination "whenever it receives credible 
information calling into question a participant's eligibility as a Veterans-owned small 
business (VOSB)." As a result, CVE did not require firms who were verified under the 
process before enactment of P.L. 1 1 1-275 in October 2010 and whose period of 
eligibility has not expired, to initiate reverification prior to the expiration of their eligibility. 
All new applicants and all reverification applicants are processed under the post-201 
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Veterans Affairs 



Enclosure 

Department of Veterans Affairs (VA) Comments to 
Government Accountability Office (GAO) Draft Report: 
"SERVICE-DISABLED VETERAN-OWNED SMALL BUSINESS PROGRAM - 
Vulnerability to Fraud and Abuse Remains" 

(GAO-1 2-697) 

Act verification procedures. All companies whose verification has expired (verification 
approval more than two years old) are ineligible for contract awards and must go 
through reverification under the process established after P.L. 1 1 1-275 in order to 
become eligible for a VA Veterans First award. 
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Veterans Affairs 



Enclosure 

Department of Veterans Affairs (VA) Comments to 
Government Accountability Office (GAO) Draft Report: 
•SERVICE-DISABLED VETERAN-OWNED SMALL BUSINESS PROGRAM - 
Vulnerability to Fraud and Abuse Remains" 
(GAO-1 2-697) 



See comment 1. 



See comment 1. 



Technical Comments 

Page 2, Paragraph 2, Line 13: "In 201 1 , VA's Office of Inspector General also found 
on the basis of a random sample of 42 firms that 32 of 42 firms listed in VetBiz database 
under the 2006 Act were ineligible for the VA SDVOSB program." 

Page 14, Paragraph 2, Line 2: "However, even if VA had verified these firms under the 
2006 act, past audits show the risk of providing SDVOSB contracts to firms reviewed 
under this process. ..VA's own OIG reviewed both SDVOSBs and VOSBs in VetBiz and 
found 32 of 42 SDVOSBs and VOSBS as verified under the 2006 Act process were in 
fact ineligible for their respective programs." 

VA Comment: These statements are inaccurate and misleading. The period of OIG 
examination was from June 1, 2009, to May 31, 2010. This period was prior to the 
passage of P.L. 111-275. OIG reported that 32 of the 42 companies were "either 
ineligible to participate in the programs or ineligible for the awarded contracts." Prior to 
the 2010 Act, companies could legally continue to self-represent in the VIP database 
and the vast majority of the firms in VIP were self-certified. Of the 42 companies 
selected for the report, only 14 had been through VA's verification program. The rest 
were self-represented. Only three (3) verified firms out of 42 were determined to be 
ineligible based on ownership and control of the firm. As of December 201 0, only firms 
that had been verified in VIP were eligible to receive awards. All others listed in VIP 
had to be verified prior to an award being made. 

VA recommended change: Replace the Report language cited above with the 
following: "In 2010, VA's Office of Inspector General found that most of the firms in the 
VIP database were self-represented and on the basis of a random sample of 42 firms, 
that 32 of 42 firms listed in VIP were ineligible for the VA SDVOSB program. Further, 
on September 4, 201 1 , VA eliminated all self-represented firms from VIP, making them 
ineligible to receive awards. 

Page 14, Paragraph 2, Line 8: "VA's OIG also used statistical sampling methods to 
project that (1) $500 million of VA SDVOSB and VOSB contracts were awarded 
annually to ineligible firms.... if it does not strengthen its oversight and verification 
procedures." 

VA Comment: This statement is inaccurate and misleading in the context of CVE 
verification policies and process. Only three firms out of 42 were verified yet ineligible 
for awards; therefore the extrapolation is excessive. 
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Enclosure 

Department of Veterans Affairs (VA) Comments to 
Government Accountability Office (GAO) Draft Report: 
"SERVICE-DISABLED VETERAN-OWNED SMALL BUSINESS PROGRAM - 
Vulnerability to Fraud and Abuse Remains" 

(GAO-1 2-697) 



See comment 2. 



VA recommended change: Delete this statement. 

Page 7, Paragraph 3, Line 1 : "VA's Center for Veterans Enterprise (CVE) seeks to 
help Veterans interested in forming or expanding their own small business. ..technical 
assistance needs. CVE is also responsible for maintaining VetBiz and implementing 
VA's verification program." 

VA Comment: This statement is inaccurate. CVE no longer counsels Veterans 
interested in forming or expanding their own small business. Since April 201 1 , CVE's 
sole function has been to verify eligibility of firms for VA Veterans First Program. 

VA recommended change: Replace the segment in question with the following 
language: "Prior to April 201 1 , VA's Center for Veterans Enterprise (CVE) sought to 
help Veterans interested in forming or expanding their own small business... technical 
assistance needs. CVE was also responsible for maintaining VetBiz.gov and the VIP 
database and implementing VA's verification program. Beginning in April 201 1 , CVE 
has focused solely on implementing VA's verification program. The former coaching 
mission is now accomplished by referrals to our Verification Education Partners in order 
to eliminate the possibility of conflict of interest. 

Page 7, Paragraph 3, Line 7: "VA was required to notify all unverified businesses in its 
VetBiZ database. ..to establish veteran ownership and control." 

VA Comment: VA notified all unverified firms in VIP in accordance with Section 104 
(b)(2) P.L. 111-275, which states: 

"In the case of a small business concern included in the database as of the date 
of the enactment of this Act for which, as of such date, the Secretary of Veterans 
Affairs has not verified the status of such concern in accordance with paragraph 
(4) of subsection (f) of section 8127 of title 38, United States Code, as amended 
by paragraph (1 ), not later than 60 days after the date of the enactment of this 
Act, the Secretary shall notify the person who owns and control the concern 
that..." 

VA complied with the law and notified approximately 13,000 firms on December 10, 
2010. At the time the notifications went out, there were approximately 17,000 firms in 
the Vendor Information Pages (VIP). The notices went to those companies who were 
self-represented and had never submitted an application for verification, and to firms 
that had previously been verified, but whose verification had expired prior to the 



4 
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See comment 3. 



See comment 4. 



Enclosure 

Department of Veterans Affairs (VA) Comments to 
Government Accountability Office (GAO) Draft Report: 
"SERVICE-DISABLED VETERAN-OWNED SMALL BUSINESS PROGRAM - 
Vulnerability to Fraud and Abuse Remains" 

(GAO-1 2-697) 

notification. Firms with a current VA verification were not notified, in accordance with 
the provisions of the law. 

In late March 201 1 , approximately 8,000 firms were removed from VIP for failure to 
respond to the notice. CVE only removed from VIP firms that had never undergone VA 
verification. Firms that had been verified using the P.L. 109-461 process that was in 
place at the time were allowed to remain in VIP. 

VA recommended change: Replace the aforementioned segment with the following 
language: "In accordance with Section 104 (b)(2) P.L. 1 1 1-275, VA notified all 
unverified companies, firms that self-represented, or firms that had expired eligibility 
periods, listed in VIP on December 10, 2010, that they must submit a complete 
application with all documentation for verification." 

Page 8, Paragraph 2, Line 1: "SDVOSBs are required to receive a portion of 
government-wide contractual dollars annually." 

VA Comment: This statement is not correct. Agencies have goals for socioeconomic 
categories such as SDVOSBs, not requirements. 

VA recommended change: Replace this statement with the following: The Federal 
Government has a 3 percent goal for procurement with SDVOSBs annually. 

Page 11, Paragraph 1, Line 1: "VA has made numerous conflicting statements about 
its progress... in response to the 2010 Act. These statements indicate that VA has 
taken an inconsistent approach to prioritizing the verification of firms and has been 
unable to accurately track the status of its efforts." 

VA Comment: This statement is not accurate. VA has utilized a consistent approach 
to prioritization that is based on the regulation, fundamental principles of fairness, and 
availability of resources. However, VA's approach has evolved as appropriate in 
response to changes in regulation or legislation and/or resources. 

In May 201 1 , the priorities were as follows: 

(1) Verification of new applications for firms that had previously only self- 
represented in VIP (i.e., firms that had not been reviewed under processes 
created for the 2006 Act or 2010 Act); 

(2) Verification of new firms that had initially applied for verification after the 
enactment of the 2010 Act; 
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Enclosure 

Department of Veterans Affairs (VA) Comments to 
Government Accountability Office (GAO) Draft Report: 
"SERVICE-DISABLED VETERAN-OWNED SMALL BUSINESS PROGRAM - 
Vulnerability to Fraud and Abuse Remains" 

(GAO-1 2-697) 

(3) Requests for reconsideration from firms denied verification; and 

(4) Reverification of applications for firms initially verified in VIP under the 
process implemented for the 2006 Act. 

"Unverified" firms were listed in VIP as "pending" but were not eligible for an award of 
contracts. They were eligible to submit proposals and those that were pending award 
received top priority for verification as part of "fast track" program. 

VA removed or verified all unverified firms from VIP by September 4, 201 1 . Once that 
was accomplished, CVE initiated an active outreach to promote reverification of firms 
verified prior to implementation of P.L. 1 1 1-275. 

In October 201 1 , the priority was: 

(1) Verification of new firms that had initially applied for verification after the 2010 
Act; 

(2) Requests for Reconsideration from firms denied verification; and 

(3) Reverification of applications for firms initially verified in VIP under the 
process implemented for the 2006 Act. 

Based on available resources, CVE determined that it was not able to complete 
reverification in as timely a way as might be desired and therefore, beginning on 
June 6, 2012, CVE executed a Class Deviation process that placed all firms whose 
eligibility had expired in a special category "reverification." In accordance with the 
published Class Deviation, firms in this category are not eligible to receive awards until 
reverification is completed. To avoid damaging these firms, a "Fast Track" process was 
initiated for firms pending award that gives them top priority. Since June 6, 2012, the 
priority has been: 

(1) Fast Track for firms in "reverification" status that are pending award; 

(2) Simplified reverification of firms verified using P.L. 111-275 process; 

(3) Verification of new firms using the 2010 Act procedures; 

(4) Requests for Reconsideration from firms denied verification; and 

(5) Reverification of applications for firms initially verified in VIP under the 
process implemented for the 2006 Act. 

CVE has reported to GAO its progress on eliminating "unverified firms" and tracks those 
firms that were verified pre-P.L. 1 1 1-275 and post-P.L. 1 1 1-275. The VetBiz Case 
Management System (VCMS) does not contain historical data and does not provide the 
capability to track the status of all firms in VIP. As a result, information is stored in 
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several secure locations and the lack of a comprehensive case management 
information system has created the need for manual workarounds and generated 
inconsistent aggregate reporting. In order to track overall status, CVE has established 
the VIP Master Inventory List (See Attachment A) outside of VCMS. 

VA recommended change: Replace the aforementioned language with the following: 
"VA verification priorities have evolved over time. Progress has enabled VA to verify all 
firms in VIP, but VA has not completed verification of all firms using the process applied 
after the 201 Act. Lack of a comprehensive management information system in VCMS 
has made it difficult for CVE to track the status of firms in the aggregate. CVE has had 
to establish and maintain the VIP Master Inventory outside of VCMS to in order to track 
overall status. The lack of a comprehensive case management system has created the 
need for manual workarounds and resulted in inconsistent aggregate reporting." 

Page 11, Paragraph 1, Line 4: "VA's most-recent numbers indicate that thousands of 
SDVOSBs listed as eligible in VetBiz received millions of dollars in SDVOSB sole- 
source and set-aside contract obligations even though they had not been verified under 
the new requirements of the 2010 Act." 

VA Comment: This statement is incorrect and misleading as it does not provide the full 
picture. No firms were listed in VIP as verified that had not been verified under the 
requirements of P.L. 109-461. Those that were not verified, were listed as "Pending" 
and were verified prior to an award being made. 

P.L. 109-461 as amended and the Regulation 38 CFR Part 74 requires all firms in VIP 
to be verified. It does not specify verified under the process established in the wake of 
P.L. 1 1 1 -275. All firms in VIP have been verified. All firms verified under the new 
process have been verified with full document reviews. P.L. 1 1 1-275 was primarily 
enacted to address those firms listed on VIP but not yet verified. It did not invalidate 
prior verification determinations. 

CVE has initiated reverification for those firms whose eligibility has expired, but it has 
only initiated reverification of firms verified prior to 1 1 1 -275 in accordance with 
38 CFR § 74.15 (c) that only authorizes CVE to initiate a verification examination 
"whenever it receives credible information calling into question a participant's eligibility 
as a VOSB." 

CVE initiated a more robust review process as a result of P.L.1 1 1-275 (which was only 
made possible via a large infusion of people and resources). The older process met the 
requirements of P.L. 109-461 . When additional resources became available, CVE 

7 



Page 39 



GAO-12-697 SDVOSB Program 



Appendix I: Comments from the Department of 
Veterans Affairs 



Enclosure 



See comment 6. 



Department of Veterans Affairs (VA) Comments to 
Government Accountability Office (GAO) Draft Report: 
"SERVICE-DISABLED VETERAN-OWNED SMALL BUSINESS PROGRAM - 
Vulnerability to Fraud and Abuse Remains" 

(GAO-1 2-697) 

expanded the scope of its evaluations and adopted a strategy designed to reverify firms 
verified under the older process as their eligibility expired, but in accordance with our 
priorities, reverification was the lowest priority. 

VA recommended change: Replace the aforementioned language with the following: 
"VA's most recent numbers indicate thousands of SDVOSBs listed as eligible in VetBiz 
received millions of dollars in SDVOSB sole source and set-aside contract obligations 
were verified under the P.L. 109-461 process, rather than the more robust process 
initiated by the 2010 act. Limitations imposed by the regulation at 38 CFR §74.15 and 
the VA verification priorities have impeded CVE from immediately completing 
verification of all firms using the process established by the 2010 Act." 

Page 1 1 , Paragraph 2, Line 1 : "VA has provided a number of conflicting statements 
and explanations related to the status of its verification program, indicating that it is 
having difficulty tracking its inventory of firms and whether they were verified under the 
process implemented to carry out the 2010 Act." 

Page 1 3, Paragraph 1 , Line 8: "Over the next month, VA officials provided us with at 
least seven differing accounts of the number of SDVOSBs verified under the processes 
for the 2006 Act and 2010 Act... Without a clear inventory and methods designed to 
track the verification process firms have undergone, VA cannot provide reasonable 
assurance that all firms appearing in VetBiz have been verified as owned and controlled 
by a veteran or service-disabled veteran." 

Page 12, Paragraph 2, Line 2: "However, our review ... raises concerns ...whether VA 
knows how many of its firms have actually been verified pursuant to the requirements of 
the 2010 Act." 



VA Comment: These statements are inaccurate and misleading. CVE knows how 
many firms have been verified, and is able to track its inventory of firms using VMIL. No 
firm appears in VIP as eligible for an award unless it is verified as owned and controlled 
by a Veteran or service-disabled Veteran. Those listed as "reverification" are not 
eligible to receive awards without undergoing verification using the 2010 Act process. 
CVE staff provided a variety of responses over time based on their best understanding 
of the parameters of the particular questions and the situation at the time of the 
question. The limitations of VCMS preclude obtaining comprehensive information 
easily. Unfortunately, VCMS does not distinguish between firms verified under the older 
process and those verified under the newer process. It only tracks the initial verification 
date of a firm after May 201 1 , so tracking and inventory are done manually, outside of 
VCMS, the VA's information management system. These limitations require CVE to 
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manually manage its inventory of businesses in VIP including last verified date and the 
process under which they were verified outside VCMS using VMIL. 

Since September 4, 201 1 , all firms appearing in VIP have been verified either under the 
older process or by the current process established after P.L. 1 1 1-275 was enacted. 
VA has a clear inventory (See Attachment A) and can track the verification process of 
firms so that we can ensure that we only verify those firms who are indeed, eligible. 
While our ability to provide aggregate reporting has been hampered by VCMS, it has 
not precluded us from tracking individual firms. 

While we seek to have all firms verified under the post- P.L.1 1 1 -275 process and have 
initiated action to that end, as noted above, 38 CFR Part 74 does not provide authority 
to initiate that process prior to the expiration of eligibility for firms that are currently 
verified without a specific rational basis for the action. Those firms whose eligibility 
period has expired and resource limitations have precluded CVE from completing their 
reverification are listed in VIP but are annotated as "reverification" and they are not 
eligible to receive an award without being verified under the process established by the 
2010 Act. Of the 6,079 firms currently in VIP as of 13 Jul 2012, 3,733 were verified 
under P.L. 1 1 1 -275 the new process and 2,346 were verified under P.L. 1 09-461 , the 
old process. 

VA recommended change: Page 11, Paragraph 2, Line 1: Replace the 
aforementioned language with the following: "CVE has had difficulty providing 
consistent aggregate reporting due to limitations of its VCMS system. Although CVE 
reports that it is able to track its inventory outside of VCMS, limitations of the VCMS 
hamper reporting and make it difficult to track the inventory of firms." 

VA recommended change Page 13, Paragraph 1, Line 8: Replace the 
aforementioned language with the following: "Over the next month, VA officials were 
unable to provide consistent information from VCMS that clearly differentiated between 
SVOSBs verified under the processes for the 2006 Act and those verified under the 
2010 Act. Although CVE reports that all firms listed in VIP as eligible for the SDVOSB 
program have been verified as owned and controlled by a Veteran or service-disabled 
Veteran, the limitations of the VCMS hamper reporting and management." 

VA recommended change, Page 12, Paragraph 2: Our review of information 
provided by VA raises concerns that the retention of firms verified prior to the 201 Act 
increases the possibility awards will go to firms that will not be verified when the more 
rigorous process is applied. We are also concerned that as the limitations of the VCMS 
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system increase, the potential for CVE to lose track of how many firms have actually 
been verified also increases. 

Page 12, Paragraph 1, Line 2: "...within 60 days of the law's enactment VA was 
required to notify all firms listed in its VetBiz database about the need to apply for 
reverification...." 

VA Comment: This statement is not correct. Section 104 (b)(2) of P.L. 1 1 1-275 
stipulated: "In the case of a small business concern included in the database as of the 
date of the enactment of this Act for which, as of such date, the Secretary of Veterans 
Affairs has not verified the status of such concern in accordance with paragraph (4) of 
subsection (f) of section 8127 of title 38, United States Code, as amended by paragraph 
(1), not later than 60 days after the date of the enactment of this Act, the Secretary shall 
notify the person who owns and controls the concern." 

VA met the mandate in the law to notify unverified firms in VIP that they must submit 
documentation for verification. At that time, VIP had approximately 17,000 companies, 
about 6,000 of whom were verified. VA sent out 13,000 notifications in December 2010 
to firms who had never been verified or whose verification term had expired. 

VA recommended change: "within 60 days of the law's enactment VA was required to 
notify all unverified firms listed in its VetBiz database about the need to apply for 
verification in accordance with Section 104 (b)(2) P.L. 111-275. VA notified all 
unverified companies in VIP on December 10, 2010, that they must submit a complete 
application with all documentation for verification. Those unverified firms that failed to 
comply, were removed from VIP." 

Page 12, Paragraph 1, Line 5: "VA Officials told us that the agency prioritized its 
verification under 201 Act by. . .and 3) applications for firms initially verified in VetBiz 
under the process implemented for the 2006 Act." 

VA Comment: This statement is not correct. Since an analysis of verification denials 
revealed that most were a result of ignorance of the details of 38 CFR Part 74, rather 
than any attempt to defraud, the Request for Reconsideration process gave a firm a 
"second chance" if it modified its business model to fit the requirements of 38 CFRPart 
74. As a result, firms that were denied were allowed to make legal changes to their 
official corporate or company documentation and then request reconsideration. It then 
enters a completely separate queue and since such firms are designated higher risk 
than an initial application, they received a new, comprehensive examination of all 
documentation and a review by VA's Office of General Counsel in many cases. 
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See comment 8. 



See comment 9. 



VA recommended change: Replace the sentence with the following: "VA Officials 
told us that the agency prioritized its verification under the 2010 Act by reviewing 
(1) new applications for firms that had previously only self-certified in VetBiz (i.e., firms 
that had not been reviewed under processes created for the 2006 Act or 2010 Act); (2) 
new firms that had initially applied for verification after the 2010 Act; (3) Requests for 
Reconsideration from firms denied verification; and 4) applications for firms initially 
verified in VIP under the process implemented for the 2006 Act." 

Page 1 2, Paragraph 2, Line 3: "First, in July 201 1 , VA stated that it removed 8,000 of 
the 13,000 SDVOSBs and VOSBs listed in VetBiz because these firms had not 
complied with VA's December 2010 letter requesting..." 

VA Comment: This statement is misleading. The only firms removed in March 201 1 
were those 'pending' firms that did not respond to VA's December 2010 notification of 
CVE's new review process, elimination of inclusion in VIP based upon self-certification, 
and the requirement that all applicant firms submit documentation for the examination in 
order to participate in the VA Veterans First Program. The 8,000 non-responsive firms 
were removed in March 201 1 . 

VA recommended change: Replace the aforementioned with the following language: 
"In July 201 1 , VA stated that it removed 8,100 unverified firms in March 201 1 of the 
13,000 SDVOSBs and VOSBs listed in VIP because these firms had not complied with 
the December 2010 notification." 



Page 12, Paragraph 2, Line 6: "On November 30, 201 1 , VA reported that it had 
removed all "unverified" firms from its database by September 4, 201 1 ." 

VA Comment: This statement is accurate. No firm appears in VIP unless it has been 
verified. For purposes of P.L. 109-461, VA has always interpreted 'verified' as any 
company that has been verified under either the P.L. 109-461 process of primarily 
public records review or under the full documentation review implemented upon 
passage of P.L. 1 1 1-275. VA has never deviated from that position and all statements 
by VA leaders are consistent with that position. 

Page 12, Footnote 32, "...firms that were in fact ineligible for the program received 
approximately $16 million in VA SDVOSB set-aside and sole source contract 
obligations..." 
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VA Comment: VA does not believe this to be a true statement. All firms receiving 
awards were listed in VIP based on verification of their eligibility under P.L. 109-461. 

VA recommended change: "...firms that were not verified under the 2010 Act process 
received approximately $16 million in VA SDVOSB set-aside and sole source contract 
obligations..." 



Page 13, Paragraph 1, Line 1: 

still needed to be verified." 



.in February 2012, ... did not explain how many firms 



VA Comment: In February 2012, all firms in VIP had been verified, as reported by 
CVE. 

VA recommended change: Replace the end of the statement starting at "...did not 
explain how..." with "did not report how many firms were verified under the older 
process." 

Page 13, Paragraph 1, Line 3: "Then, on April 23, 2012, officials told us that they had 
recently removed thousands of firms from VetBiz because these firms had not supplied 
the supporting documentation required for verification under the requirements of the 
2010 Act... not clear whether these firms received the December 2010 request..." 

VA Comment: This statement is not correct. CVE removed 3,019 firms that had not 
supplied documentation to support reverification . To avoid overwhelming the system, 
CVE did not reach out to all firms needing to be reverified at once. None of the firms 
had received the December 2010 letter because they were all verified as eligible to 
participate in Veterans First at that time of the notification. 

As of May 6, 2012, all firms whose eligibility had expired had their status in VIP changed 
to "reverification." In this status, firms may bid on solicitations, but are not eligible to 
receive awards. They may be Fast Tracked through the verification process if they are 
the apparently successful offer or on a Veterans First contract solicitation. 

VA recommended change: Replace the section beginning at "...removed thousands 
.." with "removed thousands of firms from VIP because they had not supplied supporting 
documentation required for reverification under the requirements of the 2010 Act.. .none 
of these firms received the December 2010 request." 
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Page 13, Paragraph 2, Line 1 : "The most recent information we have from VA 
indicates that thousands of potentially ineligible firms remain listed in VetBiz because 
they have not been verified under the requirements of the 2010 Act." 

VA Comment: This statement is not accurate and is misleading. All firms in VIP have 
been verified and are eligible to receive a contract award with the exception of firms 
listed as "reverification." Verification is based on an evaluation at a particular point in 
time. All firms in VIP, regardless of when they were verified, have the potential to be 
ineligible. 

VA recommended change: Replace the sentence with the following: "The most 
recent information we have from VA indicates that thousands of firms verified under the 
old process remain listed in VetBiz." 

Page 13, Paragraph 2, Line 4: "Of these 3,717 firms listed as eligible on April 1, 2012, 
134 received a total of $90 million ... from November 30, 2011, to April 1, 2012. On 
May 14, 2012, VAtold us that it removed 1,857 of these 3,717 SDVOSBs..." 

VA Comment: This statement is misleading. All the firms listed in VIP on April 1, 2012, 
were eligible to receive awards on that date. CVE removed 1 ,857 firms on 
May 14, 2012, because they did not respond to requests to undergo reverification. 
Since GAO did not investigate any of the 134 firms mentioned, VA has no basis to 
reverify them prior to expiration of their eligibility. 

VA recommended change: As all firms in VIP during that time period were eligible, 
this statement should be removed. 

Page 14, Paragraph 1, Line 2: "According to VA, the remaining 1,860 firms that 
require a review under the 2010 Act process are projected to be removed in July 2012 
unless the firms provide adequate documentation supporting their eligibility. VA also 
stated that these firms are identified as being in "reverification" and no such expired firm 
is eligible for an actual contract award until reverification has been completed." 

VA Comment: This statement is not accurate due to the rule change in effect June 27, 
2012. Specifically, the number 1,860 is no longer accurate. All firms whose two year 
eligibility period has expired are removed from VIP. If they have initiated reverification, 
they are listed as in "reverification" and are ineligible to receive a contract award. No 
expired firms are eligible to receive a contract award. 
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VA recommended change: Remove "1 ,860", as this number is no longer accurate 
based upon the rule change. 



See comment 14. 



See comment 15. 



Page 15, Figure 3: 

VA Comment: This figure is misleading. VA has provided documentation that VA 
considers it sufficient to close all of these recommendations. GAO has not provided any 
information to VA concerning what additional action is required for GAO to consider the 
recommendations to be closed. If GAO does not believe VA actions to be sufficient, VA 
requests that GAO provide VA information on what additional action is needed to close 
each recommendation. 

VA recommended change to Figure 3: VA recommends that GAO adjust the table to 
reflect VA action on each GAO recommendation. If VA action is not sufficient, include 
information in the table that shows progress VA has made on implementing each 
recommendation and information as to what VA needs to additionally provide in order 
for GAO to close each recommendation. 

Page 18, Bullet one: "VA has not provided regular Fraud Awareness Training" 

VA Comment: This statement is not correct. As the report notes, the Office of General 
Counsel provides periodic training on verification criteria which includes discussion of 
fraud risk. 

VA recommended change: Close recommendation. 

Page 19, Bullet one: "VA has not developed and implemented specific processes and 
criteria for the Debarment Committee on compliance with the requirement in the 2006 
Act to debar, for a reasonable period, firms and related parties that misrepresent their 
SDVOSB status. According to VA, its Debarment Committee relies on procedures 
outlined in the FAR and the VA Acquisition Regulations to determine the length of 
debarments." 

VA Comment: Since each case must be adjudicated on its specific circumstances, 
developing a standardized chart for the length of debarment is implausible. The 
debarring official will base the period of debarment on the circumstances surrounding 
the cause for debarment. Specific procedures are contained in the VAAR. Subpart 
809.406-3 provides procedures for debarment and subpart 809.407-3 provides 
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procedures for suspensions. VAAR subpart 809.406-2 (a) identifies causes for 
debarment and states; "misrepresentation of Veteran Owned Small Business (VOSB) or 
SDVOSB eligibility may result in action taken by VA officials to debar the business 
concern for a period not to exceed 5 years from contracting with VA as a prime 
contractor or a subcontractor." VAAR subpart 809.406-4 provides further guidance on 
the period of debarment by stating, "Except in an unusual circumstance, the period of 
debarment will not exceed 3 years." 

VA recommended change: Close recommendation. 

Page 19, Bullet two: "VA has not developed specific guidelines outlining the 
Debarment Committee's decision process to debar firms that misrepresent their 
SDVOSB status. VA should provide the Debarment Committee with guidelines to aid its 
decision-making process in determining what constitutes a "misrepresentation" 
deserving of debarment, as that term is used in the 2006 Act." 

VA Comment: VA has provided guidance on the type of information needed and 
identified the standard being used (subpart 819.70) by the committee to initiate the 
process. Once received, VA evaluates each action on a case-by-case basis. A copy of 
the referral guidance can be found at 
http://www.va.aov/oal/business/8127debarments.asp . 

The 8127 Debarment Committee will only accept referrals from VA officials. All referrals 
must include sufficient supporting information to warrant review by the Committee, such 
as: 

• The allegation of misrepresentation as a VOSB or SDVOSB and/or the violation 
of the limitations on subcontracting requirements of actions awarded under 
VAAR Subpart 819.70: 

• The identity of business concerns involved in the allegations; 

• The identifying information for any solicitations or contractual actions relating to 
the allegations; 

• Copies of relevant documents that support the allegations; 

• Whether anyone else has reviewed the allegations, and if so, copies of those 
complaints or recommendations for debarment; and 

• Contact information for the VA official making the recommendation. 

The 8127 Debarment Committee will not review unsupported allegations. The serious 
nature of debarment and suspension requires that these sanctions be imposed only in 
the public interest for the government's protection and not for purposes of punishment. 

15 



Page 47 



GAO-12-697 SDVOSB Program 



Appendix I: Comments from the Department of 
Veterans Affairs 



See comment 17. 



See comment 18. 



Enclosure 

Department of Veterans Affairs (VA) Comments to 
Government Accountability Office (GAO) Draft Report: 
"SERVICE-DISABLED VETERAN-OWNED SMALL BUSINESS PROGRAM - 
Vulnerability to Fraud and Abuse Remains" 

(GAO-1 2-697) 

The 8127 Debarment Committee uses as the guide to determine misrepresentation the 
following information from 38 U.S.C. Section 8127(g): "Any business concern that is 
determined by the Secretary to have misrepresented the status of that concern as a 
small concern owned and controlled by Veterans or as a small business concern owned 
and controlled by service-disabled veterans for purposes of this subsection shall be 
debarred from contracting with the Department for a reasonable period of time, as 
determined by the Secretary." VAAR Subpart 809.406-2 (b) provides additional 
information on the causes of debarment; "any deliberate violation of the limitation on 
subcontracting clause requirements for acquisitions under VAAR subpart 819.70 
(Service-Disabled Veteran-Owned and Veteran-Owned Small Business Acquisition 
Program) may result in action taken by VA officials to debar any service-disabled 
veteran-owned, veteran-owned small business concern or any large business concern 
involved in such action." 

VA recommended change: Close recommendation. 

Page 19, Bullet 3: "VA has not developed procedures on removing SDVOSB contracts 
from ineligible firms. According to the VA Acquisition Regulations, the Deputy Senior 
Procurement Executive has the authority to determine whether VA should terminate a 
contract with a debarred firm. However, VA has not developed procedures to remove 
SDVOSB contracts from ineligible firms. According to VA, it is in the process of 
developing a policy on removing SDVOSB contracts from ineligible firms as determined 
by status protests. In addition, VA is in the process of providing guidance to the 
acquisition workforce on removing SDVOSB contracts from ineligible firms. Until VA 
develops procedures on removing SDVOSB contracts from ineligible firms, the 
SDVOSB program is at risk for ineligible firms to abuse the program and retain 
contracts obtained through fraud and abuse." 

VA Comment: VA has determined that contracting officers will follow the guidance for 
continuation of current contracts found in FAR 9.405-1 and VAAR 809.405-1 . No 
additional policy is required at this time. 

VA recommended change: Close recommendation. 

Page 20, Bullet 1 : "VA has not formalized procedures to advertise debarments and 
prosecutions. VA has not formalized procedures for advertising debarments and 
prosecutions, though the Debarment Committee, the OIG, and CVE have listed these 
actions on their websites." 
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VA Comment: VA follows the procedures required in FAR 9.404 to advertise all 
suspensions and debarments in the Excluded Parties List System (EPLS), which is 
operated by the General Service Administration and is consulted by, and used by, all 
Federal agencies. In addition to EPLS, VA has developed its own Web site to 
specifically advertise (and emphasize) SDVOSB suspensions and debarments. 
Debarment actions can be found at 

http://www.va.gov/oal/business/8127debarmentActions.asp. Further, as was previously 
provided, VA advertises debarments and prosecutions on the Web sites of the 
Debarment Committee, OIG, and CVE also formally posts debarments and 
prosecutions on VetBiz. 

VA recommended change: Close the recommendation. 
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Affairs (VA) Office of Inspector General (OIG) reported on its findings 
in 201 1 and also to indicate that the report includes all firms in VetBiz, 
not just those verified under the Veterans Benefits, Health Care, and 
Information Technology Act of 2006 (2006 Act) process. The 
remainder of VA's comments related to the OIG report are inaccurate, 
based on our review of the report and discussions with VA's OIG staff. 
See the Agency Comments and Our Evaluation section of this report 
for more detail. 



2. In the final report, we deleted the draft report's discussion of 
information about the Center for Veterans Enterprise (CVE) being 
responsible for helping veterans who are interested in forming or 
expanding their own small businesses. 

3. Our report's characterization of the Veterans Small Business 
Verification Act (2010 Act), part of the Veterans' Benefits Act of 2010, 
is correct and we did not make associated changes to the report. 
While VA's recommended change points out that VA removed firms 
that self-represented or had expired eligibility periods, these 
categories of firms are included by the "all unverified businesses" 
language in the existing report language. 

4. We deleted the sentence stating that SDVOSBs are required to 
receive a portion of government-wide contractual dollars annually. 

5. We have revised our draft report to note that according to VA, (1 ) the 
lack of a comprehensive case-management system has created the 
need for aggregate workarounds and resulted in inconsistent 
aggregate reporting, (2) the limitations of the case-management 
system make it difficult to track the inventory of firms, and (3) as the 
limitations of the case-management system increase over time, the 
potential of CVE to lose track of how many firms have been verified 
also increases. We also acknowledge VA's assertion that its 
verification priorities have evolved overtime. However, not all of the 
conflicting statements VA made can be attributed to inadequacies in 
its case-management system or to evolving priorities. One of the 
many examples relates to the December 2010 request for 
documentation mentioned in the 2010 Act. Specifically, on April 23, 
2012, VA told us that between late March 2012 and early April 2012 it 
had removed over 3,000 SDVOSBs and VOSBs because these firms 
had failed to provide requested business documentation. We asked 
whether the firms removed in April 2012 had been sent this request. 
In response, VA told us that the firms removed in April 2012 did not 



Page 50 



GAO-12-697 SDVOSB Program 



Appendix I: Comments from the Department of 
Veterans Affairs 



receive the December 2010 document. Then on May 12, 2012, VA 
told us the firms had in fact been sent the December 2010 letter. 
Later, on June 20, 2012, VA told us that it did not send the December 
2010 letter to all firms listed in VetBiz at the time to avoid a flood of 
applications. In its agency comments, VA states that the 2010 Act did 
not require it to send all firms listed in VetBiz in December 2010 a 
request for documentation if the firms had been verified under the 
2006 Act and this verification had not yet expired. 

6. We revised the text in our draft report to more-clearly reflect that 
thousands of SDVOSBs listed as eligible in VetBiz received millions of 
dollars in contract obligations even though they had not been verified 
under the more-thorough process that VA implemented in response to 
the 2010 Act. VA's recommended changes also suggest that firms 
that were verified under the 2006 Act process could not be 
immediately reverified under the more-thorough 2010 Act process 
because, in addition to resource-allocation priorities, VA was limited 
by the requirements of 38 C.F.R. § 74.15(c). However, we note that 
VA has latitude under the law to modify its own regulations as 
necessary to ensure that only valid SDVOSBs are included in VetBiz. 
Furthermore, VA's recent decision to amend 38 C.F.R. § 74.15 and 
extend the VetBiz eligibility term from 1 year to 2 years appears to be 
a self-created impediment to ensuring all firms expeditiously undergo 
the more-thorough 2010 Act process. 

7. We revised the text in our report to reflect that the 2010 Act required 
VA to notify all unverified firms about the need to apply for verification. 

8. The language VA objects to concerning VA's prioritization of 
verifications under the 2010 Act process is taken directly from 
documentation provided by VA during the course of our audit. 
Accordingly, we made no changes to the report. 

9. The language VA objects to concerning removal of firms is taken 
directly from oral and written statements made by VA during the 
course of our audit. Accordingly, we made no changes to the report. 

10. The firms mentioned in this footnote are related to one of the new 
cases we reviewed as a result of allegations we received from 
confidential informants. These firms were not verified under the 
process implemented under the 2010 Act and we determined that 
they were in fact ineligible for the SDVOSB program because the 
firms' operating agreements allowed the two minority owners to 
control the firms, rather than the service-disabled veteran. These firms 
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received approximately $16 million in VA SDVOSB set-aside and 
sole-source contract obligations from October 2010 to December 
201 1. Accordingly, we made no changes to the report. 

1 1 . We revised our report to make clear that we were referring to 
verification using the processes implemented under the 2010 Act. 

12. We received conflicting statements from VA as to which firms 
received the December 2010 notification later and have revised the 
text to clearly reflect this fact. 

13. We revised the text in our report to more-clearly reflect that thousands 
of potentially ineligible firms remain listed in VetBiz because they have 
not been verified under the more-thorough process implemented for 
the 2010 Act. While these firms have been verified under the 2006 Act 
process, past audits show the potential risk of providing SDVOSB 
contracts to firms reviewed under this process. VA's recommended 
change does not acknowledge this risk and is therefore incomplete. 
Moreover, our statements that were related to the number of firms not 
verified under the requirements of the 2010 Act, the dollar amounts 
those firms received, and the number of firms VA planned to remove 
were all supported by evidence and were accurate at the close of our 
audit work. We have clarified the report to indicate that fact and 
included information on the requirements of the interim final rule VA 
implemented on June 27, 2012. Specifically, in our final report we 
have noted that the rule extends a firm's eligibility period for 2 years. 
We also note that VA interprets "verified" to include any firm that has 
been verified under either the 2006 Act or 2010 Act processes, 
meaning that this rule will allow thousands of firms to remain eligible 
for contracts even though they have not undergone the more- 
thorough process implemented under the 2010 Act process. See the 
Agency Comments and Our Evaluation section of this report for a 
more-thorough discussion of this issue. 

14. To this point, VA has not provided sufficient documentation to close 
the 7 recommendations that remain open. GAO will continue to work 
with VA to confirm the status of its efforts to address our 
recommendations and will close recommendations, as long as 
necessary supporting evidence is provided. 

15. Our report states that VA has made progress in the area of fraud- 
awareness training. However, VA has not provided any 
documentation to show that fraud-awareness training is being 
provided on a regular basis, as we recommended. Our 
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recommendation will remain open until necessary evidence to close it 
is provided. Accordingly, we have not changed the language in our 
report. 

16. The FAR and the VA Acquisition Regulations do not provide specific 
processes and criteria for the Debarment Committee on compliance 
with the requirement in the 2006 Act to debar, for a reasonable period 
of time, firms and related parties that misrepresented their SDVOSB 
status. VA should provide additional guidance to the Debarment 
Committee on the specific process and criteria to use to debar firms 
as required by the 2006 Act. Accordingly we have not changed the 
language in our report. 

17. The recommendation requested that VA develop specific guidelines 
outlining the Debarment Committee's decision process to debar firms 
that misrepresent their SDVOSB status. VA needs to provide 
supporting documentation demonstrating that VA provided the 
Debarment Committee with the guidance outlining the decision 
process to debar firms that misrepresent their SDVOSB status. 
Accordingly, we have not changed the language in our report. 

18. VA cites provisions of the FAR and the VA Acquisition Regulations 
containing guidance for continuing current contracts to firms that were 
found ineligible through the debarment process. However, our 
recommendation asked VA to develop procedures to remove 
SDVOSB contracts from ineligible firms. Accordingly, we have not 
changed the language in our report. 

19. Our report acknowledges that VA advertises the debarments and 
prosecutions on the Debarment Committee, VA OIG, and CVE 
websites. However, our recommendation specifically asked for VA to 
formalize procedures to advertise debarments and prosecutions, and 
we have not received any documentation related to such procedures. 
Accordingly, we have not changed the language in our report. 
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